CVE-2015-1925

The exploit targets Tivoli Fastback Server running on Windows 10 (x86, build: 16299), affecting version 6.1.4, where an unauthenticated attacker can perform a buffer overflow through a raw socket connection, resulting in remote code execution (RCE). This exploit assumes ASLR is not forced upon the vulnerable software through Windows Defender Exploit Guard (WDEG) or similar.

-blue)

[!NOTE] This exploit was developed while experimenting with custom reverse shell payloads and Data Execution Prevention (DEP) bypass techniques. Since the vulnerable application does not enable DEP by default, it must be enforced through WDEG to test the bypass. Enabling DEP is optional, as the exploit also functions when DEP is not enforced.

Process

1. The following packet is sent to the FastBackServer.exe application on TCP port 11460:

   root@kitploit:~

   header {
       00<size> 00000000 00000000 00000000
       <opcode> <offset> 00<size> <offset>
       00<size> 00<size> <offset> 00000000
       00000000 00000000 00000000 00000000
   }
   buffer { 
       <buffer-1>
       <buffer-2>
       <buffer-3>
   }
   

   The header specifies the requested functionality through an opcode, along with attributes describing the supplied data such as size and offset. The first DWORD specifies the total packet size.

2. When the packet is received, the _FXCLI_OraBR_Exec_Command function is invoked to interpret the desired functionality (through the opcode) and redirect the execution to the appropriate code-block. Since our packet is sent with the opcode 534, the application will redirect the execution to a block that contains a call to the _FXCLI_SetConfFileChunk function.

3. The _FXCLI_SetConfFileChunk function invokes _sscanf without proper bounds checking, utilizing <buffer-1> as source buffer. Overflowing this buffer with exactly 276 bytes overwrites the return address.

4. The return address is overwritten with the static address 0x50501110 (located in csftpav6.dll). When the function returns, execution continues at this address, starting the ROP chain. The ROP chain invokes VirtualAlloc to mark the memory region containing the shellcode as executable, bypassing DEP. The invocation details are specified below:

[!NOTE] The shellcode provided with this exploit does not exceed 4Kb in size, hence why dwSize is set to 1 which corresponds to one page.

5. The shellcode walks the Process Environment Block (PEB) and retrieves a handle to kernel32.dll through the InInitializationOrderModuleList.

6. A custom-written GetProcAddress function is used which compares values hashed by the rot13 algorithm to find the appropriate stubs (through RVA's in the export table). With this, we retrieve handles to the following APIs (used to initiate a reverse-shell connection):

   • kernel32!TerminateProcess
   • kernel32!CreateProcessA
   • kernel32!LoadLibraryA
   • ws2_32!WSAStartup
   • ws2_32!WSASocketA
   • ws2_32!WSAConnect

7. The exploit simultaneously binds to the local interface and listens on TCP port 4444. Once the shellcode executes, the compromised system initiates a connection back to this listener, establishing the reverse shell session.

8. When the reverse shell session is terminated using the command, the shellcode invokes TerminateProcess to gracefully terminate the vulnerable application.

Chart

flowchart TD

subgraph A[Attacker host]
  A1[Run script with target parameter]
  A2[Resolve local host address]
  A3[Set local port 4444]
  A4[Generate reverse shellcode]
  A5[Build DEP NX bypass payload with ROP]
  A6[Send exploit payload to target]
  A7[Start listener and wait for callback]
end

subgraph B[ROP and shellcode construction]
  B1[Build shellcode]
  B2[Resolve kernel32 and required APIs using hashing]
  B3[Load ws2_32 and initialize winsock]
  B4[Connect back to attacker host and port]
  B5[Spawn command shell and redirect input output]
  B6[Create VirtualAlloc call frame placeholders]
  B7[ROP writes VirtualAlloc address into stub]
  B8[ROP sets return address to shellcode]
  B9[ROP sets lpAddress to shellcode location]
  B10[ROP sets memory size allocation and protection flags]
  B11[ROP performs stack pivot and triggers VirtualAlloc]
  B12[Final payload layout VAS + ROP + padding + shellcode]
end

subgraph C[Delivery to target]
  C1[Create packet header with opcode offset and length]
  C2[Embed payload into File format string field]
  C3[Open TCP connection to target port 11460]
  C4[Send packet with length prefix]
end

subgraph D[Target processing and exploitation]
  D1[Target parses incoming packet]
  D2[sscanf copies string into fixed buffer]
  D3[Buffer overflow overwrites control data]
  D4[Execution reaches attacker controlled ROP chain]
  D5[ROP allocates executable memory using VirtualAlloc]
  D6[Execution jumps to injected shellcode]
  D7[Shellcode opens reverse connection]
end

subgraph E[Reverse shell session]
  E1[Listener accepts incoming connection]
  E2[Display exploited remote address]
  E3[Read remote output]
  E4[Send operator commands]
  E5[Close connection when finished]
end

A1 --> A2 --> A3 --> A4 --> A5 --> A6 --> A7

A4 --> B1
A5 --> B6
B1 --> B2 --> B3 --> B4 --> B5 --> B12
B6 --> B7 --> B8 --> B9 --> B10 --> B11 --> B12

A6 --> C1 --> C2 --> C3 --> C4 --> D1 --> D2 --> D3 --> D4 --> D5 --> D6 --> D7 --> E1
A7 --> E1 --> E2 --> E3 --> E4 --> E5

Usage

usage: exploit.py [-h] -t TARGET

options:
  -h, --help           show this help message and exit
  -t, --target TARGET