diff --git a/modules/exploits/multi/http/churchcrm_install_unauth_rce.rb b/modules/exploits/multi/http/churchcrm_install_unauth_rce.rb index 1d31f8cf91..12a4e69b15 100644 --- a/modules/exploits/multi/http/churchcrm_install_unauth_rce.rb +++ b/modules/exploits/multi/http/churchcrm_install_unauth_rce.rb @@ -71,15 +71,18 @@ class MetasploitModule < Msf::Exploit::Remote end # Check if the target is up by accessing the setup page - def check_if_up + def check print_status('Checking if the target is reachable...') + res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'setup') }) unless res && (res.code == 301 || res.code == 200) fail_with(Failure::Unreachable, 'Target is not reachable') + return Exploit::CheckCode::Unknown('Target setup page is inaccessible') end + return Exploit::CheckCode::Appears print_good('Target is reachable.') end @@ -171,7 +174,6 @@ class MetasploitModule < Msf::Exploit::Remote end def exploit - check_if_up alter_config case target.name