rapid7/metasploit-framework — pull request #1759 by andrewkabai (2013-04-24 08:43:52+00:00)
Title: SAP ConfigServlet remote code execution exploit

This module allows remote code execution on the target system
by using operating system commands (CmdStagerVBS) through the
SAP ConfigServlet OS command execution vulnerability,
and of course without any authentication.

The vulnerability was discovered by ERPScan's team, it was presented on Hacker Halted 2012 conference:
http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf

This module is an exploit version of the previously merged auxiliary module:
https://github.com/rapid7/metasploit-framework/pull/1751