---
description: PG Practice Kevin writeup
---

# Kevin

## Nmap

```
sudo nmap   192.168.214.45 -p- -sS -sV

PORT      STATE SERVICE            VERSION
80/tcp    open  http               GoAhead WebServer
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn        Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds       Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
3389/tcp  open  ssl/ms-wbt-server?
3573/tcp  open  tag-ups-1?
49152/tcp open  msrpc              Microsoft Windows RPC
49153/tcp open  msrpc              Microsoft Windows RPC
49154/tcp open  msrpc              Microsoft Windows RPC
49155/tcp open  msrpc              Microsoft Windows RPC
49158/tcp open  msrpc              Microsoft Windows RPC
49160/tcp open  msrpc              Microsoft Windows RPC
Service Info: Host: KEVIN; OS: Windows; CPE: cpe:/o:microsoft:windows
```

Default page for Port 80 at: [http://192.168.214.45/index.asp](http://192.168.214.45/index.asp) Takes us to a login screen for HP Power Manager. A quick Google search reveals the default credentials are `admin:admin`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a734539f050f4c1c6c96e6445478d44d75e3a69b%2Fimage.png?alt=media)

After logging in moving over to the help tab reveals version information.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ec538372c6f7f26e8f7acae682d2b27b48ce8d0c%2Fimage.png?alt=media)

`Searchsploit` reveals HP Power Manager is vulnerable to a remote buffer overflow given **CVE-2009-3999.**

**Description:**

Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long file Name parameter.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5f552d32b25eef8c437fbf937806cd3049881d10%2Fimage.png?alt=media)

{% embed url="https://www.exploit-db.com/exploits/18015" %}

The following MSF module was used: `exploit/windows/http/hp_power_manager_filename`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-402700ec6e63daee029f44bc257cc9f4877ff02a%2Fimage.png?alt=media)
