module

HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow

Try Surface Command
Back to search
Disclosed
2010-05-11
Created
2018-05-30

Description

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
prior to NNM_01203. By making a specially crafted HTTP request to the "snmpviewer.exe"
CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary
code.

The vulnerable code lies within a function within "snmpviewer.exe" with a
timestamp prior to April 7th, 2010. This vulnerability is triggerable via either a GET
or POST request. The request must contain 'act' and 'app' parameters which, when
combined, total more than the 1024 byte stack buffer can hold.

It is important to note that this vulnerability must be exploited by overwriting SEH.
While the saved return address can be smashed, a function call that occurs before
the function returns calls "exit".

Author

jduck jduck@metasploit.com

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/http/hp_nnm_snmpviewer_actapp
    msf exploit(hp_nnm_snmpviewer_actapp) > show targets
        ...targets...
    msf exploit(hp_nnm_snmpviewer_actapp) > set TARGET < target-id >
    msf exploit(hp_nnm_snmpviewer_actapp) > show options
        ...show and set options...
    msf exploit(hp_nnm_snmpviewer_actapp) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today