File tree Expand file tree Collapse file tree 1 file changed +7
-3
lines changed
modules/exploits/windows/misc Expand file tree Collapse file tree 1 file changed +7
-3
lines changed Original file line number Diff line number Diff line change @@ -16,11 +16,15 @@ def initialize(info={})
1616 super ( update_info ( info ,
1717 'Name' => 'HP Data Protector 8.10 Remote Command Execution' ,
1818 'Description' => %q{
19- A remote command execution is triggered when a crafted command is sent to the Hp Data
20- Protector Manager on TCP Port 5555.
19+ This module exploits a remote command execution on HP Data Protector 8.10. Arbitrary
20+ commands can be execute by sending crafted requests with opcode 28 to the OmniInet
21+ service listening on the TCP/5555 port. Since there is an strict length limitation on
22+ the command, rundll32.exe is executed, and the payload is provided through a DLL by a
23+ fake SMB server. This module has been tested successfully on HP Data Protector 8.1 on
24+ Windows 7 SP1.
2125 } ,
2226 'Author' => [
23- 'Christian Ramirez' , # POC,
27+ 'Christian Ramirez' , # POC
2428 'Henoch Barrera' , # POC
2529 'Matthew Hall <hallm[at]sec-1.com>' # Metasploit Module
2630 ] ,
You can’t perform that action at this time.
0 commit comments