Add in ability to restore settings n documentation changes.

Previously there was not the ability to restore the server proxy setting.
This updates the code to do so. Additionally this also updates the documentation
to note that Fetch payloads are incompatible with this module since they
use HTTP connections that will be impacted by this module changing the server's
HTTP proxy settings. There is no way around this.
This commit is contained in:
Grant Willcox
2023-05-29 15:38:04 -05:00
parent 965311d09e
commit f7d2cdae56
2 changed files with 73 additions and 8 deletions
@@ -11,6 +11,9 @@ running ADManager Plus, which will typically be the local administrator.
Note that the attacker must be authenticated in order to send requests to `/api/json/admin/saveServerSettings`,
so this vulnerability does require authentication to exploit.
As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads
with this exploit, since these will use HTTP connections that will be affected by the change in configuration.
## Verification Steps
1. Set up a Windows Server target as a domain controller server.