Description
This module will generate a plugin, pack the payload into it and upload it to a server running Piwik. Superuser Credentials are required to run this module. This module does not work against Piwik 1 as there is no option to upload custom plugins. Piwik disabled custom plugin uploads in version 3.0.3. From version 3.0.3 onwards you have to enable custom plugin uploads via the config file. Tested with Piwik 2.14.0, 2.16.0, 2.17.1 and 3.0.1.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/unix/webapp/piwik/superuser_plugin_uploadmsf undefined(superuser_plugin_upload) > show actions ...actions...msf undefined(superuser_plugin_upload) > set ACTION < action-name >msf undefined(superuser_plugin_upload) > show options ...show and set options...msf undefined(superuser_plugin_upload) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub