Body and Multipart

Body patterns other than URL-encoded forms.

JSON body

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'run'),
  'ctype' => 'application/json',
  'data' => {
    'code' => cmd,
    'timeout' => 5
  }.to_json
)

It is safer to use either vars_post or data, rather than both.

When sending to a JSON API after a form login, specify keep_cookies on login. Subsequent requests then need no cookie key: saved cookies are attached automatically. See Authentication and Cookies for the steps.

Omitting ctype on a POST adds application/x-www-form-urlencoded. When sending JSON, specify 'ctype' => 'application/json'. If the server requires response content negotiation, also add 'Accept' => 'application/json' to headers. ctype specifies the format of the outgoing body; Accept specifies the desired response format.

Arbitrary Content-Type and raw body

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'ingest'),
  'ctype' => 'application/xml',
  'data' => "<ping>#{cmd}</ping>"
)

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'upload'),
  'ctype' => 'application/octet-stream',
  'data' => payload.encoded
)

Rex::MIME::Message (classic multipart)

data = Rex::MIME::Message.new
data.add_part(payload.encoded, 'application/octet-stream', 'binary', 'form-data; name="file"; filename="uploaded.bin"')
data.add_part('example', nil, nil, 'form-data; name="_wpnonce"')

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'async-upload.php'),
  'ctype' => "multipart/form-data; boundary=#{data.bound}",
  'data' => data.to_s,
  'keep_cookies' => true
)

This has the same structure as example_webapp.rb.

vars_form_data (multipart as an array)

Newer modules can use vars_form_data, an Array of Hashes.

vars_form_data = [
  {
    'name' => 'bigUploadFile',
    'data' => file_contents,
    'filename' => file_name,
    'content_type' => 'application/octet-stream'
  },
  {
    'name' => 'path',
    'data' => '/tmp'
  }
]

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'upload.php'),
  'vars_form_data' => vars_form_data,
  'vars_get' => { 'action' => 'post-unsupported' }
)

Field key	Meaning
name	Form field name
data	Body (String, etc.)
filename	File name (attachment, if present)
content_type	Part Content-Type (the key read by client_request.rb)
encoding	Transfer encoding

Real example: modules/exploits/linux/http/chamilo_bigupload_webshell.rb (field array structure). Use content_type exactly as named in the implementation.

In the rare case where you need a fixed boundary, pass vars_form_data_boundary. Automatic generation is normally sufficient.

Cleanup after a file upload

register_file_for_cleanup(file_name)

Include FileDropper.