From efffbf751ac8b05b9bc5e4d5ade02db747d1c259 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 23 May 2014 15:05:30 -0500 Subject: [PATCH] PHP module shouldnt zap CMD option (@wchen-r7) As far as I can tell, there is no purpose for this cleanup. No other CMD exec module takes pains to clear out CMD after run, and it looks like a bad idea -- what happens when you rexploit? --- modules/exploits/multi/http/phpldapadmin_query_engine.rb | 7 ------- 1 file changed, 7 deletions(-) diff --git a/modules/exploits/multi/http/phpldapadmin_query_engine.rb b/modules/exploits/multi/http/phpldapadmin_query_engine.rb index 1315ed710e..fb087c952d 100644 --- a/modules/exploits/multi/http/phpldapadmin_query_engine.rb +++ b/modules/exploits/multi/http/phpldapadmin_query_engine.rb @@ -87,13 +87,6 @@ class Metasploit3 < Msf::Exploit::Remote return res.get_cookies end - def cleanup - # We may not be using php/exe again, so clear the CMD option - if datastore['CMD'] - datastore['CMD'] = nil - end - end - def exploit # if we are using the exec CMD stager # important to check which php functions are disabled