exodusintel/disclosures

disclosures's Issues

No shell - but crashes ASA.....

Hey there. I tested this using IKEv2 on a Cisco ASA5510 running v8.4.1 software.

The exploit crashes the ASA "Reason: Heap memory corrupted" and simply reloads - but never attempts a shell on TCP port 4444. My ASA and attacker machine are on the same network. During the crash, I see lots of 0x41 (As) which indicate control of memory....?

I have also attached the console session output during the full crash..... Any idea what needs to be tweaked?

ciscoasa# show crashinfo | include 41 41
0xd8cb5848: 23 01 1c a1 e0 00 00 00 41 41 41 41 41 41 41 41 | #.......AAAAAAAA
0xd8cb5858: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5868: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5878: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5888: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5898: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb58a8: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5848: 23 01 1c a1 e0 00 00 00 41 41 41 41 41 41 41 41 | #.......AAAAAAAA
0xd8cb5858: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5868: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5878: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5888: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb5898: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA
0xd8cb58a8: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 | AAAAAAAAAAAAAAAA

IKEv1 Support?

I guess there's not a simple way to make this exploit works with IKEv1 proto, is there?
I've tried playing with "version", "exchange type" and other parts, comparing them with the pcap from ike-scan, but without luck!

Please give me an advice if I should'nt re-write the exploit from the "start".

Thank you anyway