module
HP Data Protector 6.1 EXEC_CMD Command Execution
| Disclosed | Created |
|---|---|
| Feb 7, 2011 | May 30, 2018 |
Disclosed
Feb 7, 2011
Created
May 30, 2018
Description
This module exploits HP Data Protector's omniinet process, specifically
against a Windows setup.
When an EXEC_CMD packet is sent, omniinet.exe will attempt to look
for that user-supplied filename with kernel32!FindFirstFileW(). If the file
is found, the process will then go ahead execute it with CreateProcess()
under a new thread. If the filename isn't found, FindFirstFileW() will throw
an error (0x03), and then bails early without triggering CreateProcess().
Because of these behaviors, if you try to supply an argument, FindFirstFileW()
will look at that as part of the filename, and then bail.
Please note that when you specify the 'CMD' option, the base path begins
under C:\.
against a Windows setup.
When an EXEC_CMD packet is sent, omniinet.exe will attempt to look
for that user-supplied filename with kernel32!FindFirstFileW(). If the file
is found, the process will then go ahead execute it with CreateProcess()
under a new thread. If the filename isn't found, FindFirstFileW() will throw
an error (0x03), and then bails early without triggering CreateProcess().
Because of these behaviors, if you try to supply an argument, FindFirstFileW()
will look at that as part of the filename, and then bail.
Please note that when you specify the 'CMD' option, the base path begins
under C:\.
Authors
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.