HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager versions 7.53 and earlier. Specifically this vulnerability is caused by a failure to properly handle user supplied input within the HTTP request including headers and the actual URL GET request. Exploitation is tricky due to character restrictions. It was necessary to utilize a egghunter shellcode which was alphanumeric encoded by muts in the original exploit. If you plan on using exploit this for a remote shell, you will likely want to migrate to a different process as soon as possible. Any connections get reset after a short period of time. This is probably some timeout handling code that causes this.

Search Other Modules

Exploit Rank

• Good

Exploit Authors

• bannedit < bannedit [at] metasploit.com >
• muts < >

Vulnerability References

• CVE-2008-1697
• OSVDB-43992
• BID-28569

Exploit Targets

• 0 - Automatic Targeting (default)
• 1 - Windows 2003/zip.dll OpenView 7.53
• 2 - Windows 2000/jvm.dll OpenView NNM 7.51

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/http/adobe_robohelper_authbypass
• exploit/windows/http/altn_securitygateway
• exploit/windows/http/altn_webadmin
• exploit/windows/http/amlibweb_webquerydll_app
• exploit/windows/http/apache_chunked
• exploit/windows/http/apache_mod_rewrite_ldap
• exploit/windows/http/apache_modjk_overflow
• exploit/windows/http/badblue_ext_overflow
• exploit/windows/http/badblue_passthru
• exploit/windows/http/bea_weblogic_jsessionid

Exploit Usage Information

Exploit Module Options