ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
232 lines
No EOL
7.5 KiB
Text
232 lines
No EOL
7.5 KiB
Text
Source: http://aluigi.org/adv/snabase_1-adv.txt
|
|
|
|
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: Microsoft Host Integration Server
|
|
http://www.microsoft.com/biztalk/en/us/host-integration.aspx?pf=true
|
|
Versions: <= 8.5.4224.0
|
|
Platforms: Windows
|
|
Bugs: various Denial of Service vulnerabilities
|
|
Exploitation: remote, versus server
|
|
Date: 11 Apr 2011
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bugs
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
From vendor's website:
|
|
"Microsoft Host Integration Server technologies and tools enable
|
|
enterprise organizations to integrate existing IBM host systems,
|
|
programs, messages and data with new Microsoft server applications."
|
|
|
|
|
|
#######################################################################
|
|
|
|
=======
|
|
2) Bugs
|
|
=======
|
|
|
|
|
|
The following are only Denial of Service vulnerabilities and there are
|
|
for sure some others but sincerely who cares?
|
|
Just for quick reference...
|
|
|
|
|
|
A]
|
|
--
|
|
Endless loop affecting all the services that use the TCP protocol so
|
|
snabase.exe on port 1478, all the snalink.exe on their dynamic ports,
|
|
snaservr.exe, mngagent.exe and so on.
|
|
The cause is "word[packet] - 2" that forces the continuous parsing of
|
|
the same data.
|
|
|
|
|
|
Instead the following bugs affect only the UDP protocol used in
|
|
snabase.exe listening on the port 1478.
|
|
When this service terminates also the others depending by it like
|
|
snalink and msngagent will terminate.
|
|
|
|
B]
|
|
--
|
|
0101FAC7 |> 0FB785 E0FEFF>|MOVZX EAX,WORD PTR SS:[EBP-120]
|
|
0101FACE |. 6BC0 37 |IMUL EAX,EAX,37
|
|
0101FAD1 |. 8B8D DCFEFFFF |MOV ECX,DWORD PTR SS:[EBP-124]
|
|
0101FAD7 |. 8D1C08 |LEA EBX,DWORD PTR DS:[EAX+ECX]
|
|
0101FADA |. 8D73 0E |LEA ESI,DWORD PTR DS:[EBX+E]
|
|
0101FADD |. 89B5 D8FEFFFF |MOV DWORD PTR SS:[EBP-128],ESI
|
|
0101FAE3 |. 6A 0F |PUSH 0F
|
|
0101FAE5 |. 59 |POP ECX
|
|
0101FAE6 |. 8B3D FC690301 |MOV EDI,DWORD PTR DS:[10369FC]
|
|
0101FAEC |. 83C7 14 |ADD EDI,14
|
|
0101FAEF |. 33C0 |XOR EAX,EAX
|
|
0101FAF1 |. F3:A6 |REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS> ; unallocated memory
|
|
|
|
the crash is caused by the tentative of accessing the unallocated
|
|
memory located after the packet of max 0x1ee bytes.
|
|
|
|
|
|
C]
|
|
--
|
|
an UDP packet longer than 0x1ee bytes blocks the receiving of any
|
|
other UDP packet.
|
|
|
|
|
|
D]
|
|
--
|
|
endless loop and crash:
|
|
0101AF0D /$ 8BFF MOV EDI,EDI
|
|
0101AF0F |. 55 PUSH EBP
|
|
0101AF10 |. 8BEC MOV EBP,ESP
|
|
0101AF12 |. 33D2 XOR EDX,EDX
|
|
0101AF14 |. 3955 0C CMP DWORD PTR SS:[EBP+C],EDX
|
|
0101AF17 |. 74 1E JE SHORT 0101AF37
|
|
0101AF19 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
|
|
0101AF1C |. 56 PUSH ESI
|
|
0101AF1D |> 0FB748 02 /MOVZX ECX,WORD PTR DS:[EAX+2] ; unallocated memory
|
|
0101AF21 |. 8B70 04 |MOV ESI,DWORD PTR DS:[EAX+4]
|
|
0101AF24 |. 03D1 |ADD EDX,ECX
|
|
0101AF26 |. 0FB7C9 |MOVZX ECX,CX
|
|
0101AF29 |. F7D6 |NOT ESI
|
|
0101AF2B |. 2175 0C |AND DWORD PTR SS:[EBP+C],ESI
|
|
0101AF2E |. 03C1 |ADD EAX,ECX
|
|
0101AF30 |. 837D 0C 00 |CMP DWORD PTR SS:[EBP+C],0
|
|
0101AF34 |.^ 75 E7 \JNZ SHORT 0101AF1D ; controlled cycle
|
|
0101AF36 |. 5E POP ESI
|
|
0101AF37 |> 0FB7C2 MOVZX EAX,DX
|
|
0101AF3A |. 5D POP EBP
|
|
0101AF3B \. C2 0800 RETN 8
|
|
|
|
|
|
E]
|
|
--
|
|
67489374 |. 83C4 0C ADD ESP,0C
|
|
67489377 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
|
|
6748937A |. 83C0 2C ADD EAX,2C
|
|
6748937D |. 50 PUSH EAX
|
|
6748937E |. 68 05010000 PUSH 105
|
|
67489383 |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]
|
|
67489386 |. 05 29010000 ADD EAX,129
|
|
6748938B |. 50 PUSH EAX
|
|
6748938C |. FF15 88124467 CALL DWORD PTR DS:[<&MSVCR80.strcat_s>] ; MSVCR80.strcat_s
|
|
|
|
exception if the string is too big.
|
|
|
|
|
|
F]
|
|
--
|
|
forced termination:
|
|
"Error: Primary Host Integration Server computer already running in ???"
|
|
|
|
|
|
G]
|
|
--
|
|
6748A73F . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
|
|
6748A742 . 83C0 03 ADD EAX,3
|
|
6748A745 . 50 PUSH EAX
|
|
6748A746 . 6A 10 PUSH 10
|
|
6748A748 . 68 F0F04F67 PUSH 674FF0F0
|
|
6748A74D . FF15 38134467 CALL DWORD PTR DS:[<&MSVCR80.strcpy_s>]
|
|
|
|
if the string is longer than 0x10 bytes then the server will raise an
|
|
exception and terminates.
|
|
|
|
|
|
H]
|
|
--
|
|
606CC91A 68 1C010000 PUSH 11C
|
|
606CC91F 6A 40 PUSH 40 ; allocate 0x40 bytes
|
|
606CC921 FF15 30106C60 CALL DWORD PTR DS:[<&KERNEL32.LocalAlloc> ; kernel32.LocalAlloc
|
|
606CC927 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
|
|
606CC92A 837D E4 00 CMP DWORD PTR SS:[EBP-1C],0
|
|
606CC92E 0F84 D8000000 JE 606CCA0C
|
|
606CC934 FF75 08 PUSH DWORD PTR SS:[EBP+8] ; our string
|
|
606CC937 6A 10 PUSH 10 ; max size
|
|
606CC939 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
|
|
606CC93C 83C0 0C ADD EAX,0C
|
|
606CC93F 50 PUSH EAX ; destination
|
|
606CC940 FF15 5C116C60 CALL DWORD PTR DS:[<&MSVCR80.strcpy_s>] ; MSVCR80.strcpy_s
|
|
|
|
if the string is longer than 0x10 bytes then the server will raise an
|
|
exception and terminates.
|
|
|
|
|
|
I]
|
|
--
|
|
The opcode 0x02 allows to use an arbitrary MessageId argument in
|
|
FormatMessage causing the crash through the values 0x11 and 0x26:
|
|
_snwprintf(buffer, buffer_size, "%hs", (char *)9);
|
|
|
|
|
|
J]
|
|
--
|
|
memcmp crash caused by the accessing of unallocated memory after the
|
|
packet.
|
|
|
|
|
|
K (maybe)]
|
|
----------
|
|
snabase allows to start an existent service and even passing
|
|
parameters to it through a packet with opcode 0x04.
|
|
normally this is not an issue because the server runs with an
|
|
unprivileged user (if you assign Administrator as "Service
|
|
credential" the configurator of the installer will ask for
|
|
confirmation) and as far as I know the HIS services don't use
|
|
arguments.
|
|
anyway in some particular conditions or if have been used the
|
|
Administrator credentials this feature may be "interesting".
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/snabase_1.zip
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/17159.zip
|
|
|
|
A]
|
|
nc SERVER PORT < snabase_1a.dat
|
|
|
|
others]
|
|
nc SERVER 1478 -u < snabase_1?.dat
|
|
|
|
Note that the pre-built packet files use the fixed destination name
|
|
VBOX so change the string in the packets accordingly with the real
|
|
target machine or domain name.
|
|
Note that snabase_1k.dat must be customized to work: service name,
|
|
optional arguments and remember to change at least one char of the
|
|
string at offset 3 each time or the packet will be ignored if it
|
|
contains the same string of the previous one.
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |