remove peer methods since it is already defined in Msf::Exploit::Remote::HttpClient
parent
3cc09bc3ab
commit
84ec2cbf11
|
@ -42,10 +42,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
datastore['RPORT']
|
datastore['RPORT']
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run
|
def run
|
||||||
record = "<RECORD>"
|
record = "<RECORD>"
|
||||||
record << "<NAME>SRS</NAME><OPERATION>4</OPERATION><CMD>7</CMD>" # Operation
|
record << "<NAME>SRS</NAME><OPERATION>4</OPERATION><CMD>7</CMD>" # Operation
|
||||||
|
|
|
@ -50,10 +50,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{datastore['RHOST']}:#{datastore['RPORT']}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def fingerprint(response)
|
def fingerprint(response)
|
||||||
|
|
||||||
if(response.headers.has_key?('Server') )
|
if(response.headers.has_key?('Server') )
|
||||||
|
|
|
@ -41,10 +41,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def execute_php_code(code, opts = {})
|
def execute_php_code(code, opts = {})
|
||||||
param_name = Rex::Text.rand_text_alpha(6)
|
param_name = Rex::Text.rand_text_alpha(6)
|
||||||
padding = Rex::Text.rand_text_alpha(6)
|
padding = Rex::Text.rand_text_alpha(6)
|
||||||
|
|
|
@ -47,10 +47,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def get_domain_info(session)
|
def get_domain_info(session)
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => "/RegWeb/RegWeb/GetDomainControllerServlet",
|
'uri' => "/RegWeb/RegWeb/GetDomainControllerServlet",
|
||||||
|
|
|
@ -39,10 +39,6 @@ class Metasploit4 < Msf::Auxiliary
|
||||||
deregister_options('RHOST')
|
deregister_options('RHOST')
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run_host(rhost)
|
def run_host(rhost)
|
||||||
url = normalize_uri(datastore['URI'], '/index.php/members')
|
url = normalize_uri(datastore['URI'], '/index.php/members')
|
||||||
|
|
||||||
|
|
|
@ -37,11 +37,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def anonymous_access?
|
def anonymous_access?
|
||||||
res = send_request_raw({'uri' => '/'})
|
res = send_request_raw({'uri' => '/'})
|
||||||
return true if res and res.body =~ /username = "hpsmh_anonymous"/
|
return true if res and res.body =~ /username = "hpsmh_anonymous"/
|
||||||
|
|
|
@ -29,10 +29,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
tpath = normalize_uri(target_uri.path)
|
tpath = normalize_uri(target_uri.path)
|
||||||
if tpath[-1,1] != '/'
|
if tpath[-1,1] != '/'
|
||||||
|
|
|
@ -31,10 +31,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
tpath = normalize_uri(target_uri.path)
|
tpath = normalize_uri(target_uri.path)
|
||||||
if tpath[-1,1] != '/'
|
if tpath[-1,1] != '/'
|
||||||
|
|
|
@ -30,10 +30,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def os_fingerprint(response)
|
def os_fingerprint(response)
|
||||||
if not response.headers.has_key?('Server')
|
if not response.headers.has_key?('Server')
|
||||||
return "Unkown OS (No Server Header)"
|
return "Unkown OS (No Server Header)"
|
||||||
|
|
|
@ -56,14 +56,6 @@ class Metasploit4 < Msf::Auxiliary
|
||||||
deregister_options('RHOST')
|
deregister_options('RHOST')
|
||||||
end
|
end
|
||||||
|
|
||||||
def rport
|
|
||||||
datastore['RPORT']
|
|
||||||
end
|
|
||||||
|
|
||||||
def peer(rhost)
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def get_first_session
|
def get_first_session
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => normalize_uri(target_uri.to_s, "index.php"),
|
'uri' => normalize_uri(target_uri.to_s, "index.php"),
|
||||||
|
|
|
@ -46,14 +46,6 @@ class Metasploit4 < Msf::Auxiliary
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def rport
|
|
||||||
datastore['RPORT']
|
|
||||||
end
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
|
|
||||||
traversal = "..\\" * datastore['DEPTH']
|
traversal = "..\\" * datastore['DEPTH']
|
||||||
|
|
|
@ -47,14 +47,6 @@ class Metasploit4 < Msf::Auxiliary
|
||||||
deregister_options('RHOST')
|
deregister_options('RHOST')
|
||||||
end
|
end
|
||||||
|
|
||||||
def rport
|
|
||||||
datastore['RPORT']
|
|
||||||
end
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
|
|
||||||
record = "<RECORD><NAME>SRS</NAME><OPERATION>4</OPERATION><CMD>103</CMD><PATH>#{datastore['RFILE']}</PATH></RECORD>"
|
record = "<RECORD><NAME>SRS</NAME><OPERATION>4</OPERATION><CMD>103</CMD><PATH>#{datastore['RFILE']}</PATH></RECORD>"
|
||||||
|
|
|
@ -32,10 +32,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
File.open(datastore['TARGETURIS'], 'rb').each_line do |line|
|
File.open(datastore['TARGETURIS'], 'rb').each_line do |line|
|
||||||
test_uri = line.chomp
|
test_uri = line.chomp
|
||||||
|
|
|
@ -51,12 +51,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
deregister_options('RHOST')
|
deregister_options('RHOST')
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
|
|
||||||
def auth(username, password, sid, last_login)
|
def auth(username, password, sid, last_login)
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
|
|
|
@ -70,12 +70,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
@cookie = ''
|
@cookie = ''
|
||||||
|
|
||||||
|
|
|
@ -79,10 +79,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def lookup_lhost()
|
def lookup_lhost()
|
||||||
# Get the source address
|
# Get the source address
|
||||||
if datastore['SRVHOST'] == '0.0.0.0'
|
if datastore['SRVHOST'] == '0.0.0.0'
|
||||||
|
|
|
@ -56,10 +56,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
return target_uri.path
|
return target_uri.path
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
# Check version
|
# Check version
|
||||||
print_status("#{peer} - Trying to detect installed version")
|
print_status("#{peer} - Trying to detect installed version")
|
||||||
|
|
|
@ -53,12 +53,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# Checks if target is running HavaLite CMS 1.1.7
|
# Checks if target is running HavaLite CMS 1.1.7
|
||||||
# We only flag 1.1.7 as vulnerable, because we don't have enough information from
|
# We only flag 1.1.7 as vulnerable, because we don't have enough information from
|
||||||
|
|
|
@ -65,10 +65,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
res = get_upload_form
|
res = get_upload_form
|
||||||
|
|
||||||
|
|
|
@ -53,12 +53,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
res = send_request_raw({'uri' => normalize_uri(target_uri.path)})
|
res = send_request_raw({'uri' => normalize_uri(target_uri.path)})
|
||||||
if not res
|
if not res
|
||||||
|
|
|
@ -66,10 +66,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
return uri
|
return uri
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def remote_exe(command)
|
def remote_exe(command)
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => "#{base}backend.php",
|
'uri' => "#{base}backend.php",
|
||||||
|
|
|
@ -52,10 +52,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def uri
|
def uri
|
||||||
return target_uri.path
|
return target_uri.path
|
||||||
end
|
end
|
||||||
|
|
|
@ -55,10 +55,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
return target_uri.path
|
return target_uri.path
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
# Check version
|
# Check version
|
||||||
print_status("#{peer} - Trying to detect ZeroShell")
|
print_status("#{peer} - Trying to detect ZeroShell")
|
||||||
|
|
|
@ -56,12 +56,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
res = send_request_raw({'uri' => normalize_uri(target_uri.path)})
|
res = send_request_raw({'uri' => normalize_uri(target_uri.path)})
|
||||||
if not res
|
if not res
|
||||||
|
|
|
@ -57,10 +57,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def webfolder_uri
|
def webfolder_uri
|
||||||
begin
|
begin
|
||||||
u = datastore['WRITEWEBFOLDER']
|
u = datastore['WRITEWEBFOLDER']
|
||||||
|
|
|
@ -116,10 +116,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
return nil
|
return nil
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
print_status("#{peer} - Getting a valid session...")
|
print_status("#{peer} - Getting a valid session...")
|
||||||
session = get_session
|
session = get_session
|
||||||
|
|
|
@ -114,10 +114,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
return nil
|
return nil
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
print_status("#{peer} - Getting a valid session...")
|
print_status("#{peer} - Getting a valid session...")
|
||||||
session = get_session
|
session = get_session
|
||||||
|
|
|
@ -64,10 +64,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def check
|
def check
|
||||||
|
|
||||||
begin
|
begin
|
||||||
|
|
|
@ -53,10 +53,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def get_version
|
def get_version
|
||||||
version = nil
|
version = nil
|
||||||
|
|
||||||
|
|
|
@ -55,10 +55,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
return "#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def version_soap
|
def version_soap
|
||||||
soap = <<-eos
|
soap = <<-eos
|
||||||
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.endeca.com/endeca-server/control/1/0">
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.endeca.com/endeca-server/control/1/0">
|
||||||
|
|
|
@ -92,10 +92,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
|
||||||
"#{rhost}:#{rport}"
|
|
||||||
end
|
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
|
|
||||||
# In order to save binary data to the file system the payload is written to a .vbs
|
# In order to save binary data to the file system the payload is written to a .vbs
|
||||||
|
|
Loading…
Reference in New Issue