Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure that local variable upload_path is defined #5122

Merged
merged 1 commit into from Apr 10, 2015

Conversation

joncave
Copy link
Contributor

@joncave joncave commented Apr 10, 2015

Merge upload_payload and parse_upload_response so that the upload_path variable is defined for use in error messages in the event of failure.

If the WAR upload request fails the upload response parsing code bombs out due to an undefined variable. To reproduce start a fake Tomcat server:

$ mkdir -p /tmp/tomcat/manager
$ touch /tmp/tomcat/manager/html
$ cd /tmp/tomcat/ 
$ python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...

Run the exploit:

msf > use exploit/multi/http/tomcat_mgr_upload  
msf exploit(tomcat_mgr_upload) > set RHOST 127.1.1.1
RHOST => 127.1.1.1
msf exploit(tomcat_mgr_upload) > set RPORT 8000
RPORT => 8000
msf exploit(tomcat_mgr_upload) > set FingerprintCheck false
FingerprintCheck => false
msf exploit(tomcat_mgr_upload) > exploit
[*] Started reverse handler on 127.0.0.1:4444 
[*] 127.1.1.1:8000 - Retrieving session ID and CSRF token...
[*] 127.1.1.1:8000 - Uploading and deploying oe1yNfhtJ3cdvYL0...
[-] Exploit failed: NameError undefined local variable or method `upload_path' for #<Msf::Modules::Mod6578706c...

Merge `upload_payload` and `parse_upload_response` so that the
`upload_path` variable is defined for use in error messages in the event
of failure.
@wvu wvu self-assigned this Apr 10, 2015
wvu added a commit to wvu/metasploit-framework that referenced this pull request Apr 10, 2015
@wvu wvu merged commit c6f062d into rapid7:master Apr 10, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants