automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -139299,6 +139299,72 @@
     "session_types": false,
     "needs_cleanup": true
   },
+  "exploit_windows/http/manageengine_servicedesk_plus_cve_2021_44077": {
+    "name": "ManageEngine ServiceDesk Plus CVE-2021-44077",
+    "fullname": "exploit/windows/http/manageengine_servicedesk_plus_cve_2021_44077",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2021-09-16",
+    "type": "exploit",
+    "author": [
+      "wvu <[email protected]>",
+      "Y4er"
+    ],
+    "description": "This module exploits CVE-2021-44077, an unauthenticated remote code\n          execution vulnerability in ManageEngine ServiceDesk Plus, to upload an\n          EXE (msiexec.exe) and execute it as the SYSTEM account.\n\n          Note that build 11305 is vulnerable to the authentication bypass but\n          not the file upload. The module will check for an exploitable build.",
+    "references": [
+      "CVE-2021-44077",
+      "URL-https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above",
+      "URL-https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021",
+      "URL-https://www.cisa.gov/uscert/ncas/alerts/aa21-336a",
+      "URL-https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/",
+      "URL-https://attackerkb.com/topics/qv2aD8YfMN/cve-2021-44077/rapid7-analysis",
+      "URL-https://xz.aliyun.com/t/10631"
+    ],
+    "platform": "Windows",
+    "arch": "x86, x64",
+    "rport": 8080,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Windows Dropper"
+    ],
+    "mod_time": "2021-12-09 17:27:35 +0000",
+    "path": "/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb",
+    "is_install_path": true,
+    "ref_name": "windows/http/manageengine_servicedesk_plus_cve_2021_44077",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "artifacts-on-disk"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_windows/http/maxdb_webdbm_database": {
     "name": "MaxDB WebDBM Database Parameter Overflow",
     "fullname": "exploit/windows/http/maxdb_webdbm_database",