During the process of writing a detection plugin for CVE-2016-4372 / HP c05200601, Tenable discovered these additional issues. CVE-2016-4372 describes the deserialization of Java objects associated with the Apache Commons Collections library leading to remote code execution. There are a few affected HP products, but our interest was in "HPE iMC PLAT before 7.2 E0403P04". We installed and tested "iMC PLAT 7.2 E0403P06" on a Windows 7 box to investigate further. Note that the PoC written for this advisory is Windows-centric. Don't judge us. Additionally, to anyone who ever tries to install iMC in the future: the database has some very specific settings that have to be set, just 34 pages worth.
Exploit Vector: RCE through RMI Registry
iMC has two RMI registries: euplat and seplat. You can find their configuration files in C:\Program Files\iMC\euplat\conf and C:\Program Files\iMC\seplat\conf. By looking in their configuration files we can determine that seplat listens on TCP port 18888 and euplat lists on TCP port 21195. Why are we interested in RMI registries? RMI Registries communicate with clients by serialization. Therefore it’s a very good target for investigating deserialization vulnerabilities. The next question we need to address: can a remote attacker reach the RMI registry?
albino_lobster@WIN-3QDBKNO2F6A /cygdrive/c/Program Files/iMC
$ netstat -ab | grep 18888
TCP 0.0.0.0:18888 WIN-3QDBKNO2F6A:0 LISTENING
TCP [::]:18888 WIN-3QDBKNO2F6A:0 LISTENING
albino_lobster@WIN-3QDBKNO2F6A /cygdrive/c/Program Files/iMC
$ netstat -ab | grep 21195
TCP 0.0.0.0:21195 WIN-3QDBKNO2F6A:0 LISTENING
TCP [::]:21195 WIN-3QDBKNO2F6A:0 LISTENING
Yes, the registries appear to be bound to all interfaces. Additionally, HP documentation indicates that the port range used by euplat is for "IMC master and subordinate communication" (see "TCP usage" in the 7.2 (E0403) release notes)). This means that if a firewall is configured, it should allow for these communications. We also found documentation of HP showing their user configurations with the Windows firewall completely disabled (see figure 45 on page 26 of the "Deployment Migration to New Subordinate Server Configuration Examples" document).
Based on the above, we think it is fair to say we might be able to remotely connect to one of the RMI registries. Is the serialization communication exploitable? We need to look what libraries are available. We quickly can rule out seplat. It has few libraries available and none of use to us.
Euplat is a different story. It has a few of our favorite things:
- Commons-Beanutils (RCE)
- Commons-FileUpload (Remote file manipulation)
- Jython (RCE)
- JSON-lib (RCE)
Tenable created an proof of concept (exploit_euplatRMI.py), that can use any of the three RCE libraries (usage information is in the header). The remotely executed code is run as Administrator on Windows systems. It was shared with ZDI, not you.