module

HP OmniInet.exe MSG_PROTOCOL Buffer Overflow

Try Surface Command
Back to search
Disclosed
2009-12-17
Created
2018-05-30

Description

This module exploits a stack-based buffer overflow in the Hewlett-Packard
OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b)
packet, a remote attacker may be able to execute arbitrary code with elevated
privileges.

This service is installed with HP OpenView Data Protector, HP Application
Recovery Manager and potentially other products. This exploit has been tested
against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1
of Application Recovery Manager.

NOTE: There are actually two consecutive wcscpy() calls in the program (which
may be why ZDI considered them two separate issues). However, this module only
exploits the first one.

Authors

EgiX n0b0d13s@gmail.com
Fairuzan Roslan riaf@mysec.org
jduck jduck@metasploit.com

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/misc/hp_omniinet_1
    msf exploit(hp_omniinet_1) > show targets
        ...targets...
    msf exploit(hp_omniinet_1) > set TARGET < target-id >
    msf exploit(hp_omniinet_1) > show options
        ...show and set options...
    msf exploit(hp_omniinet_1) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today