{"id":7332,"date":"2011-07-27T00:05:00","date_gmt":"2011-07-26T22:05:00","guid":{"rendered":"https:\/\/www.corelan.be\/?p=7332"},"modified":"2011-07-27T00:05:00","modified_gmt":"2011-07-26T22:05:00","slug":"metasploit-bounty-the-good-the-bad-and-the-ugly","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2011\/07\/27\/metasploit-bounty-the-good-the-bad-and-the-ugly\/","title":{"rendered":"Metasploit Bounty - the Good, the Bad and the Ugly"},"content":{"rendered":"\n

Introduction<\/h2>\n

Metasploit Bounty program<\/h3>\n

On June 14, 2011  HD Moore announced the Metasploit Bounty<\/a> contest,  offering a cash incentive for specific vulnerabilities to be submitted as modules in the Metasploit Framework<\/a>.  Titled \"30 exploits, $5000 in 5 weeks\"<\/em>,  a post<\/a> on the Rapid7<\/a> blog lists the 30 \"bounties\" selected by the MSF team, waiting for someone to claim and submit a working exploit module.<\/p>\n

Each exploit for a vulnerability listed in the top 5 list was worth USD $500, the other 25 exploits were worth USD $100 each. The deadline to submit a functional Metasploit module, bypassing ASLR and DEP where applicable, was set to July 20th.<\/p>\n

Sounds like fun, so I decided to give it a try and claimed one of the vulnerabilities from the top 25 list.<\/p>\n

The bounty contest is now closed<\/a> , so I decided to share my version of the \"code, sweat and tears\" that were required to produce a reliable exploit.<\/p>\n

 <\/p>\n

Vulnerability<\/h2>\n

Initial discovery<\/h3>\n

The challenge I selected is based on a series of vulnerabilities<\/a> (13! advisories) discovered by Luigi Auriemma, in Iconics Genesis32 (<= 9.21) and Genesis64 (<= 10.51). For the record, my exploit targets Genesis32. The Iconics website states :<\/p>\n

For 32-bit platforms, ICONICS is committed to providing product improvements and added functionality to the GENESIS32 suite of HMI\/SCADA and advanced visualization solutions for many years to come. With GENESIS32 and GENESIS64, ICONICS connects your plant-level operations to the enterprise, turning your real-time data into competitive advantage.<\/em><\/p>\n

Genesis is a HMI (Human Machine Interface) application, typically used to visualize data and provide a GUI to operators to monitor and manage various processes.<\/p>\n

The advisory reports that the GenBroker service, running on tcp port 38080, is vulnerable to an integer overflow during the handling of opcodes 3f0, 138F,1390,1391,1392,1393,1394, 1C86, 89a,89b, 450,451,454,455, 1C20,1C24.<\/p>\n

According to some of the report, when using a specially crafted packet, you can influence the size of a memory allocation needed for the creation of an array, resulting in memory corruption.<\/p>\n

 <\/p>\n

The vulnerable function<\/h3>\n

Let's take a quick look at the vulnerable code in one of the advisories<\/a>:<\/p>\n

0044AC26  |.  E8 45C5FCFF   CALL 00417170             ; get 32bit\n0044AC2B  |.  8B45 00       MOV EAX,DWORD PTR SS:[EBP]\n0044AC2E  |.  C1E0 02       SHL EAX,2                 ; * 4\n0044AC31  |.  50            PUSH EAX\n0044AC32  |.  E8 81C50500   CALL <JMP.&MFC71U.#265> ; malloc<\/span>\n...\n0044AC95  |.  8B47 28       MOV EAX,DWORD PTR DS:[EDI+28]\n0044AC98  |.  C1E0 02       SHL EAX,2                 ; * 4\n0044AC9B  |.  50            PUSH EAX\n0044AC9C  |.  C74424 20 020>MOV DWORD PTR SS:[ESP+20],2\n0044ACA4  |.  E8 0FC50500   CALL <JMP.&MFC71U.#265> ; malloc<\/span>\n...\n0044ACE9  |>  8B47 30       MOV EAX,DWORD PTR DS:[EDI+30]\n0044ACEC  |.  C1E0 02       SHL EAX,2                 ; * 4\n0044ACEF  |.  50            PUSH EAX\n0044ACF0  |.  E8 C3C40500   CALL <JMP.&MFC71U.#265> ; malloc<\/span><\/pre>\n
Apparently no check is performed on the value read from the packet before multiplying it and using it as an argument to malloc() functions. This leads to memory corruption, which can lead to code execution. Up to me to prove that code execution is possible and reliable.<\/p>\n
 <\/p>\n
Obtaining & installing the software<\/h3>\n
One of the most heard comment from other msf bounty hunters was that it didn\u2019t seem to be trivial to obtain a copy of the vulnerable version of the application (or even \u2018a\u2019 copy of the application for that matter), my case was no exception.  But luckily, I was able to get my hands on it, and managed to perform a default installation on my VM.<\/p>\n
The installer drops files in 3 locations :<\/p>\n