Metasploit Web UI Static secret_key_base Value
Posted by deepcore on September 24, 2016 – 5:13 pm
This Metasploit module exploits the Web UI for Metasploit Community, Express and Pro where one of a certain set of Weekly Releases have been applied. These Weekly Releases introduced a static secret_key_base value. Knowledge of the static secret_key_base value allows for deserialization of a crafted Ruby Object, achieving code execution. This Metasploit module is based on exploits/multi/http/rails_secret_deserialization.
Post a reply
You must be logged in to post a comment.