Directory Traversal in Novell ZENworks Configuration Management 11.1/11.1a Preboot Service

This repository contains a single Metasploit auxiliary module targeting a directory traversal vulnerability (CVE-2012-2215) in Novell ZENworks Configuration Management's Preboot Service. The exploit works by sending a specially crafted packet to TCP port 998, exploiting the service's handling of file requests to retrieve arbitrary files from the target system. The module allows the user to specify the file path and traversal depth, with a default target of the Windows hosts file. The exploit is operational and can be used to exfiltrate sensitive files from vulnerable systems. The code is written in Ruby and follows the standard Metasploit module structure, making it easy to use within the Metasploit framework.

This repository contains a single Metasploit module targeting a remote buffer overflow vulnerability (CVE-2012-2215) in Novell ZENworks Configuration Management 10 SP2's Preboot Service. The exploit works by sending a specially crafted packet with opcode 0x21 (PROXY_CMD_FTP_FILE) to TCP port 998, triggering a buffer overflow in the 'novell_pbserv.exe' process. The module constructs a ROP chain to bypass DEP and injects a user-supplied payload (such as a reverse shell) into the vulnerable service. The exploit is operational and allows for arbitrary code execution on Windows Server 2003 SP2 systems running the affected ZENworks service. The code is written in Ruby and is structured as a standard Metasploit exploit module, with all logic contained in a single file.