rapid7/metasploit-framework — pull request #3079 by Meatballs1 (2014-03-08 16:48:48+00:00)
Title: Nvidia Mental Ray Service Exploit

Vulnerable Software: http://images.autodesk.com/adsk/files/Maya_mrsat3.11.1_Win_64bit.exe

Re-did this module to take advantage of the SMBFileServer mixin and help to provide some verification that it works.

This module serves a DLL over SMB. It also has to listen on a second socket to catch a connection from the Satellite which is initiated after we send the HELLO packet.

After we have sent the HELLO, and have received the client connection, we can send the command to load the DLL via an UNC path.

## Verification
- [ ] Land #3704
- [ ] Land #3705
- [ ] Install Mental Ray Service and reboot (or start service)
- [ ] Fire exploit

## Reproduction Steps
Steps to generate the network traffic:

Install Autodesk Maya: http://www.autodesk.com/products/autodesk-maya/free-trial
Configure as per: http://seithcg.com/wordpress/?page_id=64
Install satellite service: http://images.autodesk.com/adsk/files/Maya_mrsat3.11.1_Win_64bit.exe

Use the following command to generate some networked rendering:
```"c:\Program Files\Autodesk\Maya2014\bin\Render.exe" -r mr -s 1 -e 1 -b 1 -v 5 -rnm false -x 1024 -y 435 -rp true -of tif "C:\Program Files\Autodesk\Maya2014\presets\toon\examples\CalligraphicLine.ma"```

Monitor the generated traffic in Wireshark.