CVE-2013-2370
published 2013-07-29CVE-2013-2370: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.
PriorityP269high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
61.91%
99.2th percentile
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | loadrunner | <= 11.51 | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\x54\xf2\xff\xff
- →Detect ActiveX instantiation of the lrFileIOService control by its CLSID {8D9E2CC7-D94B-4977-8510-FB49C361A139} in browser traffic or registry. ↗
- →Alert on calls to the WriteFileBinary method on the lrFileIOService ActiveX object, especially with a heap-spray address (0x0c0c0c0c) as the second argument. ↗
- →Presence of msvcr71.dll loaded in an IE process is used as an ASLR bypass; flag unexpected loading of this DLL within iexplore.exe on patched systems. ↗
- →Look for the ROP gadget address 0x7c342643 (xchg eax,esp chain inside msvcr71.dll) in memory or network shellcode streams. ↗
- →Detect the stack-adjustment prepend encoder byte sequence \x81\xc4\x54\xf2\xff\xff (add esp, -3500) in network payloads targeting IE. ↗
- →Exploit targets IE 6–9 on Windows XP/Vista/7; scope detection to those User-Agent strings when combined with the above indicators. ↗
- ·The Metasploit module targets LrWebIERREWrapper.dll version 11.50.2216.0 specifically; the ROP chain and offsets may not apply to other versions of HP LoadRunner. ↗
- ·JavaScript obfuscation is an optional module feature; network-based signatures relying on plain JS patterns may be evaded when OBFUSCATE is enabled. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP LoadRunner - lrFileIOService ActiveX Remote Code Execution (Metasploit)
exploitdb·2013-08-29
CVE-2013-2370 HP LoadRunner - lrFileIOService ActiveX Remote Code Execution (Metasploit)
HP LoadRunner - lrFileIOService ActiveX Remote Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "9.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:rank => Rank,
:classid => "{8D9E2CC7-D94B-4977-8510-FB49C361A139}",
:method => "WriteFileBinary"
})
def initialize(info={})
super(update_info(info,
'Name' => "HP LoadRunner lrFileIOService ActiveX Remote Code Execution",
'Description' => %q{
This module exploits a vulnerability on the lrFileIOService A
Metasploit
HP LoadRunner lrFileIOService ActiveX Remote Code Execution
metasploit
HP LoadRunner lrFileIOService ActiveX Remote Code Execution
HP LoadRunner lrFileIOService ActiveX Remote Code Execution
This module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7, using the LrWebIERREWrapper.dll 11.50.2216.0. In order to bypass ASLR the no aslr compatible module msvcr71.dll is used. This one is installed with HP LoadRunner.
No writeups or analysis indexed.
2013-07-29
Published