From 2f788c2e0c47e20aa87c5f790be09ce6dfd7fe78 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Wed, 24 Sep 2014 16:13:05 -0500 Subject: [PATCH] Fix description --- modules/auxiliary/admin/http/bash_env.rb | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/admin/http/bash_env.rb b/modules/auxiliary/admin/http/bash_env.rb index c6d0f7f107..1dec79b772 100644 --- a/modules/auxiliary/admin/http/bash_env.rb +++ b/modules/auxiliary/admin/http/bash_env.rb @@ -11,9 +11,15 @@ class Metasploit4 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Bash Specially-Crafted Environment Variables Code Injection Attack (PoC)', + 'Name' => 'Bash Specially-Crafted Environment Variables Code Injection Attack', 'Description' => %q{ - This module exploits a vulnerability. + This module exploits a remote command injection vulnerability in bash, + a popular shell environment, over an HTTP CGI vector. By passing a specially-crafted + string that is set as an environment variable, attckers may execute arbitrary operating + system commands. + + For this version of the exploit, the target must already have netcat (nc) compiled with the + -e option. }, 'Author' => ['wvu'], 'References' => [