HP OmniInet.exe Opcode 20 Buffer Overflow

This module exploits a vulnerability found in HP Data Protector's OmniInet process. By supplying a long string of data as the file path with opcode '20', a buffer overflow can occur when this data is being written on the stack where no proper bounds checking is done beforehand, which results arbitrary code execution under the context of SYSTEM. This module is also made against systems such as Windows Server 2003 or Windows Server 2008 that have DEP and/or ASLR enabled by default.

Search Other Modules

Exploit Rank

• Good

Exploit Authors

• Oren Isacson < >
• muts < >
• dookie < >
• sinn3r < sinn3r [at] metasploit.com >
• corelanc0d3r < peter.ve [at] corelan.be >

Vulnerability References

• CVE-2011-1865
• OSVDB-73571
• EDB-17468
• http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182

Exploit Targets

• 0 - HP Data Protector A.06.10 b611 / A.06.11 b243 XP SP3/Win2003/Win2008 (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/misc/agentxpp_receive_agentx
• exploit/windows/misc/apple_quicktime_rtsp_response
• exploit/windows/misc/asus_dpcproxy_overflow
• exploit/windows/misc/avidphoneticindexer
• exploit/windows/misc/bakbone_netvault_heap
• exploit/windows/misc/bcaaa_bof
• exploit/windows/misc/bigant_server
• exploit/windows/misc/bigant_server_250
• exploit/windows/misc/bigant_server_usv
• exploit/windows/misc/bomberclone_overflow

Exploit Usage Information

Exploit Module Options