diff --git a/lib/msf/core/exploit/http/joomla/base.rb b/lib/msf/core/exploit/http/joomla/base.rb index a778e49616..0ad1e7a333 100644 --- a/lib/msf/core/exploit/http/joomla/base.rb +++ b/lib/msf/core/exploit/http/joomla/base.rb @@ -7,15 +7,20 @@ module Msf::Exploit::Remote::HTTP::Joomla::Base # @return [TrueClass] Joomla is up and running. # @return [FalseClass] Joomla is not up. def joomla_and_online? - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path) - }) + # Possible paths that we might see the generator tag. + paths = [ '/', '/administrator' ] - if res - elements = res.get_html_meta_elements - elements.each_entry do |e| - if e.attributes['content'] && /joomla!/i === e.attributes['content'].value - return true + paths.each do |path| + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, path) + }) + + if res + elements = res.get_html_meta_elements + elements.each_entry do |e| + if e.attributes['content'] && /joomla!/i === e.attributes['content'].value + return true + end end end end