CVE-2014-4872

This Metasploit module exploits an arbitrary file upload vulnerability in Numara/BMC Track-It! by leveraging an unauthenticated .NET remoting service to upload ASP/ASPX files to the web root, achieving remote code execution as NETWORK SERVICE or SYSTEM.

The document describes multiple vulnerabilities in BMC Track-It!, including unauthenticated .NET remoting services exposing credentials and file upload capabilities, leading to remote code execution and information disclosure. It also mentions SQL injection, arbitrary file download, and hardcoded database credentials.

This Metasploit module exploits an unauthenticated .NET remoting service in BMC/Numara Track-It! to retrieve Domain Administrator and SQL server credentials. It crafts a malicious packet to query the ConfigurationService and extracts sensitive data from the response.

This Metasploit module exploits an arbitrary file upload vulnerability in Numara/BMC Track-It! versions 8 to 11.X via an unauthenticated .NET remoting service on port 9010 (or 9004 for v8). It uploads an ASP/ASPX payload to achieve remote code execution as NETWORK SERVICE or SYSTEM.