Metasploit modules that can be used to exploit HP products

Order by Disclosure Date Module Name Module Type
  • HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow
    Disclosure Date: 2010-06-08
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_ovwebsnmpsrv_uro
    This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code is within the option parsing function within "ovwebsnmpsrv.exe" with a timestamp prior to April 7th, 2010. Reaching the vulnerable code requires a 'POST' request with an 'arg' parameter that, when combined with some static text, exceeds 10240 bytes. The parameter must begin with a dash. It is important to note that this vulnerability must be exploited by overwriting SEH. This is since overflowing the buffer with controllable data always triggers an access violation when attempting to write static text beyond the end of the stack. Exploiting this issue is a bit tricky due to a restrictive character set. In order to accomplish arbitrary code execution, a double-backward jump is used in combination with the Alpha2 encoder. Authors: - jduck <jduck@metasploit.com>
  • HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow
    Disclosure Date: 2010-05-11
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_snmpviewer_actapp
    This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By making a specially crafted HTTP request to the "snmpviewer.exe" CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code lies within a function within "snmpviewer.exe" with a timestamp prior to April 7th, 2010. This vulnerability is triggerable via either a GET or POST request. The request must contain 'act' and 'app' parameters which, when combined, total more than the 1024 byte stack buffer can hold. It is important to note that this vulnerability must be exploited by overwriting SEH. While the saved return address can be smashed, a function call that occurs before the function returns calls "exit". Authors: - jduck <jduck@metasploit.com>
  • HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow
    Disclosure Date: 2010-05-11
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_getnnmdata_maxage
    This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted MaxAge parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow
    Disclosure Date: 2010-05-11
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_getnnmdata_icount
    This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted ICount parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow
    Disclosure Date: 2010-05-11
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_getnnmdata_hostname
    This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted Hostname parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution
    Disclosure Date: 2010-05-06
    First seen: 2020-04-26
    exploit/windows/misc/hp_loadrunner_magentproc_cmdexec
    This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50 and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are also most likely vulneable if the (non-default) SSL option is turned off. By sending a specially crafted packet, an attacker can execute commands remotely. The service is vulnerable provided the Secure Channel feature is disabled (default). Authors: - Unknown - aushack <patrick@osisecurity.com.au>
  • HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
    Disclosure Date: 2009-12-17
    First seen: 2020-04-26
    exploit/windows/misc/hp_omniinet_1
    This module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b) packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP Application Recovery Manager and potentially other products. This exploit has been tested against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1 of Application Recovery Manager. NOTE: There are actually two consecutive wcscpy() calls in the program (which may be why ZDI considered them two separate issues). However, this module only exploits the first one. Authors: - EgiX <n0b0d13s@gmail.com> - Fairuzan Roslan <riaf@mysec.org> - jduck <jduck@metasploit.com>
  • HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
    Disclosure Date: 2009-12-17
    First seen: 2020-04-26
    exploit/windows/misc/hp_omniinet_2
    This module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b) packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP Application Recovery Manager and potentially other products. This exploit has been tested against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1 of Application Recovery Manager. NOTE: There are actually two consecutive wcscpy() calls in the program (which may be why ZDI considered them two separate issues). However, this module only exploits the second one. Authors: - EgiX <n0b0d13s@gmail.com> - Fairuzan Roslan <riaf@mysec.org> - jduck <jduck@metasploit.com>
  • HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow
    Disclosure Date: 2009-12-09
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_snmp
    This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request to Snmp.exe, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow
    Disclosure Date: 2009-12-09
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_ovwebhelp
    This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request to OvWebHelp.exe, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow
    Disclosure Date: 2009-12-09
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_ovalarm_lang
    This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute arbitrary code. This specific vulnerability is due to a call to "sprintf_new" in the "isWide" function within "ovalarm.exe". A stack buffer overflow occurs when processing an HTTP request that contains the following. 1. An "Accept-Language" header longer than 100 bytes 2. An "OVABverbose" URI variable set to "on", "true" or "1" The vulnerability is related to "_WebSession::GetWebLocale()". NOTE: This exploit has been tested successfully with a reverse_ord_tcp payload. Authors: - jduck <jduck@metasploit.com>
  • Apache Tomcat Manager Application Deployer Authenticated Code Execution
    Disclosure Date: 2009-11-09
    First seen: 2020-04-26
    exploit/multi/http/tomcat_mgr_deploy
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - jduck <jduck@metasploit.com>
  • Apache Tomcat Manager Authenticated Upload Code Execution
    Disclosure Date: 2009-11-09
    First seen: 2020-04-26
    exploit/multi/http/tomcat_mgr_upload
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - rangercha
  • Apache Tomcat Manager Application Deployer Authenticated Code Execution
    Disclosure Date: 2009-11-09
    First seen: 2020-04-26
    exploit/multi/http/tomcat_mgr_deploy
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - jduck <jduck@metasploit.com>
  • Apache Tomcat Manager Authenticated Upload Code Execution
    Disclosure Date: 2009-11-09
    First seen: 2020-04-26
    exploit/multi/http/tomcat_mgr_upload
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - rangercha
  • Apache Tomcat Manager Application Deployer Authenticated Code Execution
    Disclosure Date: 2009-11-09
    First seen: 2020-04-26
    exploit/multi/http/tomcat_mgr_deploy
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - jduck <jduck@metasploit.com>
  • Apache Tomcat Manager Authenticated Upload Code Execution
    Disclosure Date: 2009-11-09
    First seen: 2020-04-26
    exploit/multi/http/tomcat_mgr_upload
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - rangercha
  • Hewlett-Packard Power Manager Administration Buffer Overflow
    Disclosure Date: 2009-11-04
    First seen: 2020-04-26
    exploit/windows/http/hp_power_manager_login
    This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2. Sending a specially crafted POST request with an overly long Login string, an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com> - sinn3r <sinn3r@metasploit.com>
  • Persits XUpload ActiveX MakeHttpRequest Directory Traversal
    Disclosure Date: 2009-09-29
    First seen: 2020-04-26
    exploit/windows/browser/persits_xupload_traversal
    This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX control(version 3.0.0.3) that's included in HP LoadRunner 9.5. By passing a string containing "..\" sequences to the MakeHttpRequest method, an attacker is able to write arbitrary files to arbitrary locations on disk. Code execution occurs by writing to the All Users Startup Programs directory. You may want to combine this module with the use of exploit/multi/handler since a user would have to log for the payload to execute. Authors: - jduck <jduck@metasploit.com>
  • HP OpenView Network Node Manager Toolbar.exe CGI Cookie Handling Buffer Overflow
    Disclosure Date: 2009-01-21
    First seen: 2020-04-26
    exploit/windows/http/hp_nnm_toolbar_02
    This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.0 and 7.53. By sending a CGI request with a specially OvOSLocale cookie to Toolbar.exe, an attacker may be able to execute arbitrary code. Please note that this module only works against a specific build (i.e. NNM 7.53_01195) Authors: - Oren Isacson - juan vazquez <juan.vazquez@metasploit.com> - sinn3r <sinn3r@metasploit.com>
117 metasploit modules found
1 2 3 4 5 6
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close