File tree Expand file tree Collapse file tree 1 file changed +7
-3
lines changed
modules/exploits/windows/misc Expand file tree Collapse file tree 1 file changed +7
-3
lines changed Original file line number Diff line number Diff line change @@ -16,11 +16,15 @@ def initialize(info={})
16
16
super ( update_info ( info ,
17
17
'Name' => 'HP Data Protector 8.10 Remote Command Execution' ,
18
18
'Description' => %q{
19
- A remote command execution is triggered when a crafted command is sent to the Hp Data
20
- Protector Manager on TCP Port 5555.
19
+ This module exploits a remote command execution on HP Data Protector 8.10. Arbitrary
20
+ commands can be execute by sending crafted requests with opcode 28 to the OmniInet
21
+ service listening on the TCP/5555 port. Since there is an strict length limitation on
22
+ the command, rundll32.exe is executed, and the payload is provided through a DLL by a
23
+ fake SMB server. This module has been tested successfully on HP Data Protector 8.1 on
24
+ Windows 7 SP1.
21
25
} ,
22
26
'Author' => [
23
- 'Christian Ramirez' , # POC,
27
+ 'Christian Ramirez' , # POC
24
28
'Henoch Barrera' , # POC
25
29
'Matthew Hall <hallm[at]sec-1.com>' # Metasploit Module
26
30
] ,
You can’t perform that action at this time.
0 commit comments