CVE-2013-4800
published 2013-07-29CVE-2013-4800: Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1735.
PriorityP270critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
39.30%
98.4th percentile
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1735.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | loadrunner | <= 11.51 | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\x54\xf2\xff\xff
bytes↗
\xff\xff\xff\xff (4-byte big-endian fake length header)
- →Detect exploit traffic targeting magentproc.exe on TCP/443 (SSL3): look for inbound SSL3 connections carrying a packet whose first 4 bytes are 0xFFFFFFFF (fake XDR length field) followed by a large payload exceeding ~6000 bytes. ↗
- →The exploit forces SSL version SSL3 and uses PrependMigrate; alert on SSL3 negotiation to port 443 on LoadRunner agent hosts (magentproc.exe listeners). ↗
- →The Nessus plugin hp_loadrunner_cve-2013-4800.nasl can be used to detect vulnerable HP LoadRunner agent instances. ↗
- →Stack adjustment shellcode prepend bytes 0x81 0xC4 0x54 0xF2 0xFF 0xFF (add esp, -3500) will appear immediately before the payload; scan for this byte sequence in SSL3 traffic to port 443 on LoadRunner agent hosts. ↗
- ·The Metasploit module targets only Windows XP SP3 with HP LoadRunner 11.50 (magentproc.exe version 11.50.2042.0); the RET gadget 0x7ffc070e is sourced from NLS tables and may not be stable on other OS patch levels. ↗
- ·Null byte (0x00) is a bad character for the payload encoder; payloads containing null bytes will be broken by the target service. ↗
- ·A crash length of 6000 bytes is required to reliably trigger the exception; shorter payloads may not reach the SEH overwrite. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP LoadRunner - 'magentproc.exe' Remote Overflow (Metasploit)
exploitdb·2013-10-08
CVE-2013-4800 HP LoadRunner - 'magentproc.exe' Remote Overflow (Metasploit)
HP LoadRunner - 'magentproc.exe' Remote Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'HP LoadRunner magentproc.exe Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The
vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending
a specially crafted packet, an attacker may be able to execute arbitrary code.
},
'Author' =>
[
'Unknown', # Original discovery # From Tenable Network Security
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References
Metasploit
HP LoadRunner magentproc.exe Overflow
metasploit
HP LoadRunner magentproc.exe Overflow
HP LoadRunner magentproc.exe Overflow
This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
http://osvdb.org/95644http://packetstormsecurity.com/files/123533http://www.securityfocus.com/bid/61446http://www.zerodayinitiative.com/advisories/ZDI-13-169https://exchange.xforce.ibmcloud.com/vulnerabilities/85960https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772http://osvdb.org/95644http://packetstormsecurity.com/files/123533http://www.securityfocus.com/bid/61446http://www.zerodayinitiative.com/advisories/ZDI-13-169https://exchange.xforce.ibmcloud.com/vulnerabilities/85960https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03862772
2013-07-29
Published