diff --git a/lib/takeover/web.py b/lib/takeover/web.py index b608029ad..5d06a4759 100644 --- a/lib/takeover/web.py +++ b/lib/takeover/web.py @@ -178,10 +178,11 @@ class Web: # Upload the uploader agent self.__webFileInject(uploaderContent, uploaderName, directory) - requestDir = ntToPosixSlashes(directory).replace(ntToPosixSlashes(kb.docRoot), "/").replace("//", "/") + requestDir = ntToPosixSlashes(directory).replace(ntToPosixSlashes(kb.docRoot), "/") if isWindowsPath(requestDir): requestDir = requestDir[2:] - requestDir = normalizePath(requestDir) + while requestDir.find('//') != -1: + requestDir = requestDir.replace('//', '/') self.webBaseUrl = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, requestDir) self.webUploaderUrl = "%s/%s" % (self.webBaseUrl.rstrip('/'), uploaderName) @@ -202,9 +203,9 @@ class Web: if self.webApi == "asp": runcmdName = "tmpe%s.exe" % randomStr(4) runcmdStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'), runcmdName) - match = re.search(r'input type=hidden name=scriptsdir value="([^"]+)"', uplPage) + match = re.search(r'input type=hidden name=scriptsdir value="([^"]+)"', uplPage) - if match: + if match: backdoorDirectory = match.group(1) else: continue