Exploitation Summary
EIP tracks 6 public exploits for CVE-2011-1865.
PoCs published by Metasploit, muts & dookie, Core Security, including Metasploit module exploits/windows/misc/hp_omniinet_3.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in HP Data Protector's OmniInet.exe via opcode '20', achieving arbitrary code execution under SYSTEM privileges. It bypasses DEP/ASLR using ROP techniques targeting MSVCR71.dll.
Description
Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to execute arbitrary code via a request containing crafted parameters.
Exploits (6)
This Metasploit module exploits a buffer overflow in HP Data Protector's OmniInet.exe via opcode '20', achieving arbitrary code execution under SYSTEM privileges. It bypasses DEP/ASLR using ROP techniques targeting MSVCR71.dll.
This exploit targets a remote buffer overflow in HP Data Protector 6.11, leveraging a crafted packet to overwrite EIP and execute a bindshell payload on port 4444. It uses ROP techniques to bypass DEP and achieve arbitrary code execution.
This Metasploit module exploits a buffer overflow in HP OmniInet.exe via a crafted opcode 27 packet, allowing remote code execution. It includes SEH overwrites and a payload delivery mechanism.
The provided Python script demonstrates multiple stack overflow vulnerabilities in HP Data Protector by sending crafted packets to port 5555. It exploits improper input validation in the 'data protector inet' service, leading to remote code execution or denial of service.
This Metasploit module exploits a buffer overflow in HP OmniInet.exe via a crafted opcode 27 packet, allowing remote code execution. It includes SEH overwrites and a custom payload delivery mechanism.
This Metasploit module exploits a buffer overflow vulnerability in HP Data Protector's OmniInet.exe process by sending a crafted packet with opcode '20' and a long file path, leading to arbitrary code execution under SYSTEM privileges. It includes a ROP chain to bypass DEP and ASLR on Windows systems.