{"uuid": "cbc00ff8-2596-4c6e-8858-4c30c4575719", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-0923", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"ch0ks\", \"c4an\", \"wireghoul\", \"sinn3r \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits HP Data Protector's omniinet process, specifically\\n          against a Windows setup.\\n\\n          When an EXEC_CMD packet is sent, omniinet.exe will attempt to look\\n          for that user-supplied filename with kernel32!FindFirstFileW().  If the file\\n          is found, the process will then go ahead execute it with CreateProcess()\\n          under a new thread.  If the filename isn't found, FindFirstFileW() will throw\\n          an error (0x03), and then bails early without triggering CreateProcess().\\n\\n          Because of these behaviors, if you try to supply an argument, FindFirstFileW()\\n          will look at that as part of the filename, and then bail.\\n\\n          Please note that when you specify the 'CMD' option, the base path begins\\n          under C:\\\\.\", \"disclosure_date\": \"2011-02-07\", \"fullname\": \"auxiliary/admin/hp/hp_data_protector_cmd\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"HP Data Protector 6.1 EXEC_CMD Command Execution\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/hp/hp_data_protector_cmd\", \"references\": [\"CVE-2011-0923\", \"OSVDB-72526\", \"ZDI-11-055\", \"URL-https://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux/\"], \"rport\": 5555, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:43.069291Z"}