Description
This module exploits HP Data Protector's omniinet process, specifically against a Windows setup.
When an EXEC_CMD packet is sent, omniinet.exe will attempt to look for that user-supplied filename with kernel32!FindFirstFileW(). If the file is found, the process will then go ahead execute it with CreateProcess() under a new thread. If the filename isn't found, FindFirstFileW() will throw an error (0x03), and then bails early without triggering CreateProcess().
Because of these behaviors, if you try to supply an argument, FindFirstFileW() will look at that as part of the filename, and then bail.
Please note that when you specify the 'CMD' option, the base path begins under C:\.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/admin/hp/hp/data_protector_cmdmsf undefined(data_protector_cmd) > show actions ...actions...msf undefined(data_protector_cmd) > set ACTION < action-name >msf undefined(data_protector_cmd) > show options ...show and set options...msf undefined(data_protector_cmd) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub