Skip to content

Commit 12b1936

Browse files
committed
Fixed typo added Options section docs
1 parent 9d47372 commit 12b1936

File tree

2 files changed

+11
-5
lines changed

2 files changed

+11
-5
lines changed

documentation/modules/exploit/linux/http/zyxel_parse_config_rce.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ Two caveats of this exploit chain were described by Jacob Baines in the followin
2424
This module was tested against USG Flex Version (???). To test this module you will need to acquire a hardware device
2525
running one of the vulnerable firmware versions listed above.
2626

27+
## Options
28+
29+
### WRITEABLE_DIR
30+
31+
This indicates the location where you would like the payload and exploit stored, as well
32+
as serving as a location to store the various files and directories created by the exploit itself.
33+
The default value is `/tmp`
2734

2835
## Verification Steps
2936

modules/exploits/linux/http/zyxel_parse_config_rce.rb

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,7 @@ def initialize(info = {})
2121
},
2222
'Author' => [
2323
'SSD Secure Disclosure technical team', # discovery
24-
'jheysel-r7', # Msf module
25-
'Jacob Baines', # Testing
24+
'jheysel-r7' # Msf module
2625
],
2726
'References' => [
2827
[ 'URL', 'https://ssd-disclosure.com/ssd-advisory-zyxel-vpn-series-pre-auth-remote-command-execution/'],
@@ -67,8 +66,8 @@ def check
6766
product = product_match[1]
6867
version = version_match[1]
6968

70-
if (product.starts_with?('USG') && product.includes?('W') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.10')) ||
71-
(product.starts_with?('USG') && !product.includes?('W') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.00')) ||
69+
if (product.starts_with?('USG') && product.include?('W') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.10')) ||
70+
(product.starts_with?('USG') && !product.include?('W') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.00')) ||
7271
(product.starts_with?('ATP') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.10')) ||
7372
(product.starts_with?('VPN') && Rex::Version.new(version) <= Rex::Version.new('5.36.2') && Rex::Version.new(version) >= Rex::Version.new('5.00'))
7473
return CheckCode::Appears("Product: #{product}, Version: #{version}")
@@ -94,7 +93,7 @@ def on_new_session(session)
9493
command_output = session.shell_command_token "ifconfig #{newest_gre} down && ip tunnel del #{newest_gre} mode gre && echo success"
9594
end
9695

97-
if command_output.includes?('success')
96+
if command_output.include?('success')
9897
print_good('The GRE interface was successfully removed.')
9998
else
10099
print_warning('The module failed to remove the GRE interface created by this exploit. Subsequent module runs will likely fail unless unless it\'s successfully removed')

0 commit comments

Comments
 (0)