rapid7/metasploit-framework — pull request #316 by juanvazquez (2012-04-07 17:10:14+00:00)
Title: exploit module added for CVE-2012-1195

I would like to make a contribution to metasploit with a module for "CVE-2012-1195: Lenovo ThinkManagement Console landesk/managementsuite/core/core.anonymous/ServerSetup.asmx RunAMTCommand Operation -PutUpdateFileCore Command Parsing Arbitrary File Upload" with the hope you find it useful.

The payload use the Arbitrary File Upload to upload the payload as an ASP script and execute it through a second HTTP Request.

I've tried to use the CVE-2012-1196 to delete the ASP script uploaded, but in my tests the arbitrary file deletion is limited to the $INSTALL\ldlogon path, where $INSTALL = C:\Program Files\LANDesk\ManagementSuite by default.

I've tested on Windows 2003 SP2 with windows/meterpreter_reverse_tcp.

Finally I'm learning and training exploit writing and metasploit dev so any feedback about the code is welcome!

Regards,

juan