Oracle BeeHive 2 voice-servlet prepareAudioToPlay() Arbitrary File Upload
This module exploits a vulnerability found in Oracle BeeHive. The prepareAudioToPlay method found in voice-servlet can be abused to write a malicious file onto the target machine, and gain remote arbitrary code execution under the context of SYSTEM. Authentication is not required to exploit this vulnerability.
Module Name
exploit/windows/http/oracle_beehive_prepareaudiotoplay
Authors
- mr_me <steventhomasseeley [at] gmail.com>
- sinn3r <sinn3r [at] metasploit.com>
References
Targets
- Oracle Beehive 2
Platforms
- windows
Reliability
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/http/oracle_beehive_prepareaudiotoplay
msf exploit(oracle_beehive_prepareaudiotoplay) > show targets
...targets...
msf exploit(oracle_beehive_prepareaudiotoplay) > set TARGET <target-id>
msf exploit(oracle_beehive_prepareaudiotoplay) > show options
...show and set options...
msf exploit(oracle_beehive_prepareaudiotoplay) > exploit