Exploit-DB #4720
Description: HP Compaq Notebooks - ActiveX Remote Code Execution
Type: remote
Platform: windows
Date: 2007-12-11
Author: porkythepig

Exploit:
<!-
Advisory:

Multiple Hewlett-Packard notebook series are prone to a remote code execution attack.
The manufacturer's preinstalled software contains a critical flaw within the software 
built to support one-touch button quick feature access.

Overview:
/////////

Software called "HP Info Center" is shipped with almost every HP laptop model for few years. 
It is designed to support user with quick system information and hardware configuration
using single button touch.
One of its ActiveX controls deployed by default by the vendor has three insecure methods 
that allow a malicious person to target the HP notebook machines for a remote code execution 
and remote registry manipulation based attacks.

Impact:
///////

Remote code execution
Remote system registry read/write access
Remote shell command execution

Attack vectors:
///////////////

Architecture of the vulnerable HP Info Center software gives an attacker few different 
attack vector combinations:

- remote automated download and execute (e.g. malware instalation)
- remote registry arbitrary key access (e.g. attack preparation, remote system info gathering)
- remote registry data modification (e.g. sensitive data manipulation, malware instalation, DoS attacks)
- system disk data area manipulation and user documents alteration (e.g. system files manipulation, 
	sensitive user documents access, entire system crash DoS attacks)

Any attack vector will always begin with a try to induce remote user owning a vulnerable machine to 
launch the attackers controlled WWW link.
If the victim uses diffrent browser than IE attacker will probably attempt to induce 
to open the malicious webstite from within IE.
After that the attack will follow automatic and without any need of interaction with 
the victim.

Technical analysis:
///////////////////

The vulnerable ActiveX control HPInfoDLL.dll is a component of HP Info Center application which
is a part of HP Quick Launch Buttons software deployed by the manufacturer while a default
HP machine OS installation.

It has assigned following CLSID: 

62DDEB79-15B2-41E3-8834-D3B80493887A 

and is by default included to "Safe for Scripting" OLE components group, that allows full execution 
scripting access to the control methods from within the browser.

The default AX control installation path is 
C:\Program Files\Hewlett-Packard\HP Info Center

The control contains three potentially insecure methods:

VARIANT GetRegValue(String sHKey, String sectionName, String keyName);
void SetRegValue(String sHKey, String sSectionName, String sKeyName, String sValue);
void LaunchApp(String appPath, String params, int cmdShow);

The first and second method are used to access remote registry for read and write by the HP 
update and configuration software. To access chosen registry key one must split its path 
to 3 string parameters: 
HKey parameter containing the main key handle string (for example "HKEY_LOCAL_MACHINE"),
SectionName parameter which is double-slashed string path relative to the HKey, 
and the last one - name of key to access / modify.

The third method is used by the HP Info Center application to spawn utility programs from within
the embeded IE window.
When user presses one of the Quick Launch buttons on the HP keyboard the QLBCTRL.exe process 
launches apropriate application, in this case: \HP INFO CENTER\hpinfocenter.exe, 
an application build to support the user with quick wifi configuration, update check and so on.
The application window contains enbeded IE control to launch the HPINFO ActiveX CTL.
IE uses the JS script 'HPInfoCenter.js' located in the same dir, which is used to response 
user input. When user selects the option he is intrested of, the JS code executes HPINFO 
control's LaunchApp() method, which spawns the new process using JS code-specified path. 
(e.g. Wireless Assistant, Help and Support Center, ...)
The first problem is that the path variable passed as an argument to the LaunchApp() method 
doesn't distinguish between global disk area and local HP software area.
Therefore using this method, one is able to launch ANY executable binary within the system 
within the logged user context.
Combining this method with the system command shell one can execute any shell command sequence
within the remote user context(e.g. format, del, copy ...) providing '/c' switch as a first parameter
for the cmd.exe ("execute and exit" option).

At this point, owning the shell commands execution access, CreateProcess() win32 Api function access
and access to the system directory, we can construct an armed remote code execution exploit.
All we need is to use the shell access to build remotely a batch file that after executed will 
launch 'ftp.exe' Windows NT ftp client utility, download arbitrary remote file into local system 
and execute it afterwards.
Such an exploit however, would have a visible cmd shell window during the exploit driven 
download process, so it would be easily noticeable and it would have been canceled by alerted user.

However, thanks to the vendor's programmers, we have a direct mapping of the ShowWindow() 
API function second parameter 'cmdShow' trough the LaunchApp() method interface.
Passing here value 5 (SW_SHOW) will make the created process GDI window visible in its default shape.
Passing however 0 value (SW_HIDE) will effect in a totally window-less process creation, that
will continue its execution without main window rendered and without any app-icon on a taskbar.
In short: using the HPInfo Activex control one can construct silent, windowless, 
background running, remote execution exploit, which after spawned by clicking the 
malicious website by user, will silently download arbitrary remote binary code and execute it afterwards, 
even when user changes browsed website during exploit driven download or even close the browser 
before the exploit completes.

Vuln