Remote Code Execution in HP LeftHand Virtual SAN Appliance hydra (pre-10.0)

This repository contains a single Metasploit module (modules/exploits/linux/misc/hp_vsa_login_bof.rb) that exploits a buffer overflow vulnerability (CVE-2013-2343) in HP StorageWorks P4000 Virtual SAN Appliance (VSA) versions prior to 10.0. The exploit targets the login functionality of the VSA management service, which listens on TCP port 13838. The vulnerability is due to unsafe usage of the sscanf() function when parsing login requests, allowing a remote attacker to send a specially crafted login packet and overflow a buffer, leading to arbitrary code execution as a privileged user. The module allows the attacker to supply a custom Metasploit payload (such as a reverse shell), which is delivered as part of the exploit. The code includes a check method to verify if the target is vulnerable and an exploit method that crafts and sends the malicious login packet. The only fingerprintable endpoint is the TCP service on port 13838. The repository is structured as a typical Metasploit exploit module, written in Ruby, and is operational with customizable payload support.