Re: Penetration of HP/UX

[Marco Ivaldi <raptor () mediaservice net>]

Philipp,

On Wed, 8 Jun 2011, Philipp Lachberger wrote:

> Hello fellow pen-testers,
>
> I've recently encountered a HP/UX Box in a penetration test. Now I've 
> been searching for materials on HP/UX as it is (over here) not a common 
> system to encounter.

Which version of HP-UX?

> All I've found on public search engines were links to exploits from
> 2001. Have I just not searched thoroughly enough or are there hardly any 
> papers?
>
> I would greatly appreciate it if you could give me directions to look 
> at.

Here you can find some exploits:

http://www.exploit-db.com/
http://www.metasploit.com/

That said, you don't necessarily need an exploit in order to compromise a 
system (see a few examples below).

> There are two services listening - Sendmail and ProFTPD, both not 
> obviously wrong configured.

Can you enumerate valid users via SMTP? Common things to try:

- VRFY
        $ telnet target 25
        220 target ESMTP Sendmail blah blah
        vrfy test
        550 5.1.1 test... User unknown
        vrfy root
        250 2.1.5 Super-User <root@target>
- EXPN
        $ telnet target 25
        220 target ESMTP Sendmail blah blah
        expn test
        550 5.1.1 test... User unknown
        expn root
        250 2.1.5 Super-User <root@target>
- RCPT TO (extremely common even with modern configurations)
        $ telnet target 25
        220 target ESMTP Sendmail blah blah
        helo foo
        250 target Hello blah blah, pleased to meet you
        mail from:<test () test com>
        250 2.1.0 <test () test com>... Sender ok
        rcpt to:test
        550 5.1.1 test... User unknown
        rcpt to:root
        250 2.1.5 root... Recipient ok

Once you identify some valid users, you can mount a brute force attack on 
the FTP daemon. Even if you can't enumerate valid users through SMTP, you 
can still try the brute force attack.

You can automate the process with an username dictionary and some 
scripting or with readily-available support tools, such as:

http://www.0xdeadbeef.info/code/brutus.pl
http://www.thc.org/thc-hydra/
http://www.foofus.net/~jmk/medusa/medusa.html

Finally, be sure to report all SMTP/FTP misconfigurations (is TLS 
available or credentials are transmitted in clear-text? how is TLS 
configured? is SMTP relaying properly configured? etc.)

> Exploits don't work for HP/UX as they do for "normal" Linuxes/Unixes. 
> This is because HP/UX (as far as I know) mainly works on SPARC CPU's, 
> thus having Big Endian instructions which is different from standard x86 
> - or am I wrong?

HP-UX runs on PA-RISC and Itanium, not SPARC. Sun Solaris runs on SPARC. 
Take a look here for some background:

http://www.phrack.org/issues.html?issue=58&id=11

> Thank you all for your time!

Hope this helps,

--
------------------------------------------------------------------
Marco Ivaldi                          OPSA, OPST, OWSE
Senior Security Advisor
@ Mediaservice.net Srl                Tel: +39-011-32.72.100
Via San Bernardino, 17                Fax: +39-011-32.46.497
10141 Torino - ITALY                  http://www.mediaservice.net/
------------------------------------------------------------------
PGP Key - https://keys.mediaservice.net/m_ivaldi.asc


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------