Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are:

2010-1917, 2010-2531, 2010-2939, 2010-2950, 2010-3709, 2010-2950, 2010-4156, 2011-1540, 2011-1541

I am trying to find exploits and tutorials to exploit these vulnerabilities. I searched on exploit-db.com, http://www.securityfocus.com and http://web.nvd.nist.gov.

I am getting the vulnerability details but unable to find the exploits. I found exploit code for 2010-3709 on explot-db.com but unable to understand how to use it? So

  1. Can anybody please tell me the sites where I can get exploits for these?
  2. If anyone can explain me how to exploit those vulnerabilities, I will be very thankful to him.
share|improve this question
    
If you have to ask "how" to exploit something then you have no business trying to exploit it. –  Ramhound Dec 5 '11 at 16:58
    
do you know of the many commercial exploit kits out there that may have what you are looking for (including source code) or are you only looking for free resources? –  Tate Hansen Dec 7 '11 at 7:01
    
I am looking for only free resources. –  narayan Dec 10 '11 at 22:30
add comment

3 Answers

up vote 6 down vote accepted

For the 2010-3749 issue, presuming you're looking at this exploit it doesn't really look like a canned exploit, more like an explanation of the issue. It would require for the application in question to make use of the vulnerable function for it to be exploitable.

Indeed, having a quick look through some of the issues that you've linked they look to be PHP language level issues. With this kind of problem, unless the codebase on the target system makes use of the vulnerable functionality, it may well not be exploitable. It could well be that Nessus is reporting vulnerability based on a received HTTP header which indicates an old version of PHP in use.

This doesn't necessarily mean that that the system in question is actually vulnerable

In addition to the sites you've mentioned I tend to look at cvedetails.com for any metasploit modules which may target the affected issue.

you could also try secunia.com and search for issues based on the product, as opposed to looking at language level issues.

share|improve this answer
add comment

Metasploit has a massive library of actual exploit code.

http://www.offensive-security.com/metasploit-unleashed/Introduction

share|improve this answer
add comment

Nessus and any other vulnerability scanners have some false positives when they detect "vulnerability". I saw cases in which the system was running the latest updates, and a vulnerability scanner will report that it has a "critical" vulnerability. Unless you are sure that the target system is vulnerable (you have access to the system and know what's running there), it is quite possible that what you are seeing is a just false positive.

share|improve this answer
    
Although true, this answer has nothing to do with the question asked. –  ephrack Dec 6 '11 at 11:21
    
The point is if he can't confirm if they are false positive or not he will be blindly running exploits and ultimately wasting his time. –  Bassec Dec 6 '11 at 22:45
    
I don't argue that you are wrong. What I'm saying is that it is irrelevant to the question which is where do you find exploit code. –  ephrack Dec 7 '11 at 12:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.